Subject: Tsvart last call review of draft-ietf-httpbis-bcp56bis-12

From: David Black via Datatracker <[email-masked]>
Date: Tue, 13 Jul 2021 18:23:55 -0700

Reviewer: David Black
Review result: Ready with Issues

This document has been reviewed as part of the transport area review team's
ongoing effort to review key IETF documents. These comments were written
primarily for the transport area directors, but are copied to the document's
authors and WG to allow them to address any issues raised and also to the IETF
discussion list for information.

When done at the time of IETF Last Call, the authors should consider this
review as part of the last-call comments they receive. Please always CC
[email-masked] if you reply to or forward this review.

This draft provides guidance on application use of HTTP - it is a complete
replacement of RFC 3205, reflecting considerable changes to HTTP and the
associated ecosystem over the nearly 2 decades since publication of RFC 3205.
The draft is clear and well-written - the one Issue that I found is a relatively
minor one concerning a reference.

Most of the material in this draft is about application-level use of HTTP.
The one core transport topic, transport ports, is covered in Section 4.4.3,
which is a fine example of how to deal with transport ports.  That section
contains a mercifully short discussion that includes the specific ports used
by HTTP (tcp/80 and tcp/443) complemented by a reference to RFC 7605 for
further guidance.  I tip my virtual hat in the author's direction for arranging
for that section to be numbered 4.4.3 ;-).

I did notice one non-Transport ISSUE of potential concern - Section 4.3 on
Specifying Client Behavior leads off with these two paragraphs:

   An application's expectations for client behaviour ought to be
   closely aligned with those of Web browsers, to avoid interoperability
   issues when they are used.

   One way to do this is to define it in terms of [FETCH], since that is
   the abstraction that browsers use for HTTP.

Based on this text, I was surprised to see that not only is [FETCH] an
informative reference, but that it is also a reference to a non-archival source
(WHATWG, "Fetch - Living Standard").   Given the prominent use of that
citation, I'd think that the reference ought to be a normative reference to an
archival document, perhaps complemented with advice on where to find
updated versions of that document.

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 14 Jul 2021 11:49:44 +1000

Hi David,

Thanks very much for the review. I think it's probably best to defer discussion of the issue below until the IESG does its comments/DISCUSSes, as they ultimately own policy in this area (AIUI).

Cheers,

> On 14 Jul 2021, at 11:23 am, David Black via Datatracker <[email-masked]> wrote:
> 

--
Mark Nottingham   https://www.mnot.net/