Subject: NEW ISSUE: empty Host header

From: Bjoern Hoehrmann <[email-masked]>
Date: Wed, 21 Nov 2007 16:11:15 +0100

Hi,

  The specification states "If the requested URI does not include an
Internet host name for the service being requested, then the Host header
field MUST be given with an empty value" but the grammar does not seem
to allow this.

     Host = "Host" ":" host [ ":" port ] ; Section 3.2.2

should be changed into

     Host = "Host" ":" [ host [ ":" port ] ] ; Section 3.2.2

regards,
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Weinh. Str. 22 · Telefon: +49(0)621/4309674 · http://www.bjoernsworld.de
68309 Mannheim · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Julian Reschke <[email-masked]>
Date: Wed, 21 Nov 2007 16:32:28 +0100

>      Host = "Host" ":" [ host [ ":" port ] ] ; Section 3.2.2

Good point.

So what exactly does "requested URI" refer to, and how can it ever not 
include a host name? Is this about "hostname" vs "IPv4address" 
(http://tools.ietf.org/html/rfc2396#section-3.2.2)?

BR, Julian

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Wed, 21 Nov 2007 16:52:46 +0100

>(http://tools.ietf.org/html/rfc2396#section-3.2.2)?

http://lists.w3.org/Archives/Public/ietf-http-wg-old/1999SepDec/0058 was
my interpretation so far, the thread likely has additional details.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Weinh. Str. 22 · Telefon: +49(0)621/4309674 · http://www.bjoernsworld.de
68309 Mannheim · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: "Roy T. Fielding" <[email-masked]>
Date: Wed, 21 Nov 2007 13:21:48 -0800

Host is full of baggage imposed by folks who never implemented
HTTP and had no way of knowing that mandating Host on all messages
was a complete waste of time (it had already been implemented on
all browsers).

We don't need to change the mandate, but we can improve the
description so that it explains all of the types of possible
HTTP requests and note the fact that not all URIs have a host
portion.  The empty Host is for that reason.  I thought that
this was already on the issues list, but I guess not.

Note that host in RFC3986 is already defined to allow empty
(because reg-name can be empty).

....Roy

---

From: Julian Reschke <[email-masked]>
Date: Thu, 22 Nov 2007 11:23:34 +0100

> (because reg-name can be empty).

Interesting.

So... assuming we replaced RFC2396's host with RCF3986's host, the 
following would become legal:

   Host: :81

Bug or feature?

BR, Julian

---

From: "Frank Ellermann" <[email-masked]>
Date: Thu, 22 Nov 2007 12:25:23 +0100

Julian Reschke wrote:

> assuming we replaced RFC2396's host with RCF3986's host, the 

> Bug or feature?

At some point ABNF is lost, <reg-name> can take rather odd forms:
http://%D0%B8%D1%81%D0%BF%D1%8B%D1%82%D0%B0%D0%BD%D0%B8%D0%B5.boldlygoingnowhere.org/xhtml1-i18n.dtd

Syntactically valid, I think.  It's less clear what it means.

 Frank

---

From: "Javier Godoy" <[email-masked]>
Date: Thu, 22 Nov 2007 08:56:35 -0300

Bug?

>From section 14.23

"the Host field value MUST represent the naming authority of the origin
server or gateway given by the original URL."

and

"If the requested URI does not include an Internet host name for the service
being requested, then the Host header field MUST be given with an empty
value"

I would say that it is already forbidden since I cannot see how the
zero-length host name identifies the naming authority (maybe this situation
should be explicitly stated).

Besides, I feel the second requirement conflicts with the step 2 of section
5.2 :

"2. If the Request-URI is not an absoluteURI, and the request includes
     a Host header field, the host is determined by the Host header
     field value."

Because "the requested URI" may be understood as the Request-URI... which
does not includes an Internet host name if it is not an absoluteURI (though
the user-agent possibly knows the absoluteURI).IMHO it should be replaced by
something like "if the user-agent does not know the requested URI then the
Host header field MUST be given with an empty value" or "if the user-agent
is not willing to include an Internet host name, then the Host header field
MAY be given with an empty value"

Regards

Javier

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 27 Nov 2007 21:21:43 -0800

Now i92 <http://www.w3.org/Protocols/HTTP/1.1/rfc2616bis/issues/#i92>  
(editorial).

--
Mark Nottingham     http://www.mnot.net/