Subject: Re: #306: does etag value really use quoted-string

From: Julian Reschke <[email-masked]>
Date: Mon, 24 Oct 2011 20:13:16 +0200

On 2011-08-30 13:35, Mark Nottingham wrote:
> <http://trac.tools.ietf.org/wg/httpbis/trac/ticket/306>
>
> IIRC we checked various implementations and found that many don't handle ETags as a quoted-string; therefore, the safe/sensible thing to do is to re-define ETag as a something else; i.e., something with the same syntax, but without any special semantic for backslashes.
>
> We might also caution against including backslashes in them in prose, since it isn't interoperable.
>
> Thoughts / objections?
> ...

Wrote a short test server...:

import java.io.IOException;
import java.io.OutputStream;
import java.net.InetSocketAddress;
import java.util.List;

import com.sun.net.httpserver.HttpExchange;
import com.sun.net.httpserver.HttpHandler;
import com.sun.net.httpserver.HttpServer;

public class EtagSyntax extends StylesheetAcceptHeaders {

	public static void main(String[] args) throws IOException {

		HttpServer server = HttpServer.create(new InetSocketAddress(8080), 0);

		server.createContext("/start", new ServeHtml());
		server.createContext("/simple", new ETag("\"simple\""));
		server.createContext("/escaped", new ETag("\"\\e\\s\\c\\a\\p\\e\\d\""));

		server.setExecutor(null);
		server.start();
	}

	private static class ServeHtml implements HttpHandler {

		@Override
		public void handle(HttpExchange h) throws IOException {
			String response = "<html><head><title>ETag test</title></head><body>" +
			"<h1>Simple Etag</h1>" +
			"<object data='/simple'></object>" +
			"<p><a href='/simple'>link</a></p>" +
			"<h1>Escaped Etag</h1>" +
			"<object data='/escaped'></object>" +
			"<p><a href='/escaped'>link</a></p>" +
			"</body></html>";

			h.getResponseHeaders().set("Content-Type",
					"text/html; charset=UTF-8");
			h.sendResponseHeaders(200, response.getBytes().length);
			OutputStream os = h.getResponseBody();
			os.write(response.getBytes());
			os.close();
		}
	}

	private static class ETag implements HttpHandler {
		
		private final String what;
		
		public ETag(String what) {
			this.what = what;
		}

		@Override
		public void handle(HttpExchange h) throws IOException {
			List<String> inm = h.getRequestHeaders().get("If-None-Match");
			String response = "If-None-Match: " + inm;

			System.err.println(response);
			
			h.getResponseHeaders().set("Content-Type",
					"text/plain; charset=UTF-8");
			h.getResponseHeaders().set("ETag", what);
			h.sendResponseHeaders(200, response.getBytes().length);
			OutputStream os = h.getResponseBody();
			os.write(response.getBytes());
			os.close();
		}
	}
}

...and observed what UAs do: none of the ones I tested removed the 
\-escapes, which seems to indicate they are really treating them as 
opaque strings.

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Sat, 29 Oct 2011 11:55:04 +0200

Trying to summarize where we are:

1) Yves did dome tests on servers: 
<http://lists.w3.org/Archives/Public/ietf-http-wg/2011JulSep/0266.html> 
-> the servers being tested didn't seem to unescape

2) Amos Jeffries reports that recent Squids actually *do* handle them as 
quoted-strings: 
<http://lists.w3.org/Archives/Public/ietf-http-wg/2011JulSep/0470.html>

3) I tested various browsers, and they do not unescape: 
<http://lists.w3.org/Archives/Public/ietf-http-wg/2011OctDec/0087.html>

So what do we do?

Claiming that etags use quoted-strings when almost nobody does seems to 
be a bad thing. For instance, apparently it has caused the Squid 
developers to make a change that in the best case is harmless, and in 
the worst case will break things.

Best regards, Julian