Subject: WGLC issue: following HTTP redirects

From: Peter Saint-Andre <[email-masked]>
Date: Fri, 01 Jun 2012 15:02:16 -0600

Dear HTTPBIS WG:

Please correct me if I'm wrong, but it appears that the HTTP
specifications [1] don't say anything about the circumstances under
which an HTTP client ought to, or ought not to, follow a redirect (such
as we defined for XMPP in RFC 6120 [2]).

My questions include: Is it OK if an HTTP request to somedomain.tld is
redirected to anotherdomain.tld? What about an HTTPS request? For the
latter, at what point in the secure connection request is it OK to
accept a redirect? Do both confidentiality and integrity need to be
established before it's OK to follow the redirect? Does the client need
to apply the same policies to anotherdomain.tld that it would have
applied to somedomain.tld (e.g., mandating encryption)? What server
identity does the client check (per RFC 2818)? Etc.

As I said, perhaps these matters are described somewhere and I missed
them; if so, a pointer would be appreciated.

Thanks!

Peter

[1] I checked RFC 2616, RFC 2818, draft-ietf-httpbis-p1-messaging-19,
draft-ietf-httpbis-p2-semantics-19, and
draft-ietf-httpbis-security-properties-05

[2] http://tools.ietf.org/html/rfc6120#section-4.9.3.19

---

From: Julian Reschke <[email-masked]>
Date: Sat, 02 Jun 2012 11:54:17 +0200

> as we defined for XMPP in RFC 6120 [2]).

It does say a few things about what to consider when following redirects 
to unsafe methods; but that's it.

In general, the spec describes format and semantics of HTTP messages and 
doesn't try to describe what to do with them.

> redirected to anotherdomain.tld? ...

Why not? It happens all the time.

> ... What about an HTTPS request? For the

If we need to describe it, the spec defining HTTPS probably would be the 
right place.

> [2] http://tools.ietf.org/html/rfc6120#section-4.9.3.19

Best regards, Julian

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 04 Jun 2012 09:15:27 -0600

On 6/4/12 9:13 AM, Julian Reschke wrote:
> On 2012-06-04 16:42, Peter Saint-Andre wrote:
>> ...
>> Just because something happens all the time does not mean it is safe or
>> secure. :)
>> ...
> 
> Cross-domain redirects happen so frequently (for instance, with any URI
> shortening service) that you really need to be more specific :-)
> 
>> Do you mean 2818(bis) or the security properties spec?
>>
>> In any case, I would be happy to propose text.
> 
> I meant 2818bis; the security properties spec appears to be dead.

If the 2818bis initiative starts in earnest, I shall be sure to propose
appropriate text.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 04 Jun 2012 08:42:12 -0600

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Julian Reschke <[email-masked]>
Date: Mon, 04 Jun 2012 17:13:09 +0200

Best regards, Julian