Subject: HTTP3 Pseudoheaders

From: Martin Duke <[email-masked]>
Date: Mon, 12 Aug 2019 16:35:38 -0700

I'm carefully parsing the wording in sec. 4.1.1 and want to make sure I
have this right:

"

Endpoints MUST NOT
   generate pseudo-header fields other than those defined in [HTTP2
<https://tools.ietf.org/html/draft-ietf-quic-http-22#ref-HTTP2>].
   The restrictions on the use of pseudo-header fields in
   Section 8.1.2.1 of [HTTP2
<https://tools.ietf.org/html/draft-ietf-quic-http-22#ref-HTTP2>] also
apply to HTTP/3.

"

In RFC 7540, 8.1.2.1 says

Endpoints MUST NOT
   generate pseudo-header fields other than those defined in this
   document...

Pseudo-header fields defined for requests MUST NOT appear
   in responses; pseudo-header fields defined for responses MUST NOT
   appear in requests.  Pseudo-header fields MUST NOT appear in
   trailers.  Endpoints MUST treat a request or response that contains
   undefined or invalid pseudo-header fields as malformed
   (Section 8.1.2.6
<https://www.rfc-editor.org/rfc/rfc7540.html#section-8.1.2.6>).

   All pseudo-header fields MUST appear in the header block before
   regular header fields.  Any request or response that contains a
   pseudo-header field that appears in a header block after a regular
   header field MUST be treated as malformed (Section 8.1.2.6
<https://www.rfc-editor.org/rfc/rfc7540.html#section-8.1.2.6>).

This notably does NOT include the further restrictions in 8.1.2.3:
All HTTP/2 requests MUST include exactly one valid value for the
   ":method", ":scheme", and ":path" pseudo-header fields, unless it is
   a CONNECT request (Section 8.3
<https://www.rfc-editor.org/rfc/rfc7540.html#section-8.3>).  An HTTP
request that omits
   mandatory pseudo-header fields is malformed (Section 8.1.2.6
<https://www.rfc-editor.org/rfc/rfc7540.html#section-8.1.2.6>).

To clarify, this last restriction on exactly one of these
pseudoheaders is NOT relevant to HTTP/3? i.e. Clients are free to omit
:method, :scheme, and :path from their requests?

---

From: Martin Duke <[email-masked]>
Date: Mon, 12 Aug 2019 16:39:30 -0700

Obviously it would be weird to omit a :method or have more than one, so
perhaps this is an oversight?

On Mon, Aug 12, 2019 at 4:35 PM Martin Duke <[email-masked]> wrote:

>    generate pseudo-header fields other than those defined in [HTTP2 <https://tools.ietf.org/html/draft-ietf-quic-http-22#ref-HTTP2>].
>    Section 8.1.2.1 of [HTTP2 <https://tools.ietf.org/html/draft-ietf-quic-http-22#ref-HTTP2>] also apply to HTTP/3.
>
> "
>
>    (Section 8.1.2.6 <https://www.rfc-editor.org/rfc/rfc7540.html#section-8.1.2.6>).
>
>    header field MUST be treated as malformed (Section 8.1.2.6 <https://www.rfc-editor.org/rfc/rfc7540.html#section-8.1.2.6>).
>
>    a CONNECT request (Section 8.3 <https://www.rfc-editor.org/rfc/rfc7540.html#section-8.3>).  An HTTP request that omits
>    mandatory pseudo-header fields is malformed (Section 8.1.2.6 <https://www.rfc-editor.org/rfc/rfc7540.html#section-8.1.2.6>).
>
> To clarify, this last restriction on exactly one of these pseudoheaders is NOT relevant to HTTP/3? i.e. Clients are free to omit :method, :scheme, and :path from their requests?
>
>

---

From: Willy Tarreau <[email-masked]>
Date: Tue, 13 Aug 2019 05:22:14 +0200

> perhaps this is an oversight?

Maybe the text should instead say :

  Pseudo-header generation strictly follow the rules that apply to H2
  (see RFC7540 sections X,Y,Z,...).

And probably it would be worth mentioning extensions, like RFC8441
which adds ":protocol".

Willy