Subject: p2: scope for status codes

From: Mark Nottingham <[email-masked]>
Date: Sat, 20 Apr 2013 19:14:03 +1000

Several status codes are defined in terms of indicating the server's intent, without specifying what kind of server it is.

I believe there are several that we can make more specific without too much controversy. Specifically, 

  406 Not Acceptable
  409 Conflict
  500 Internal Service Error 

can, I think, all be specified as being from the origin server.

And, if we are still OK with 403 Forbidden being generated by both origins and intermediaries, it may be helpful to explicitly state that.

Any thoughts about this? Unless someone feels strongly, I'll record it as editorial.

--
Mark Nottingham   http://www.mnot.net/

---

From: Amos Jeffries <[email-masked]>
Date: Sun, 21 Apr 2013 14:32:45 +1200

> I believe there are several that we can make more specific without too much controversy. Specifically,

Note: Squid uses 409 Conflict to signal CVE-2009-0801 validation 
mismatch between DNS, TCP and HTTP state as reason for messages being 
rejected. It is a client-end error and more expressive of the semantic 
problem than 400 or 500.

>    500 Internal Service Error

Disagree strongly with 500. It is intentionally the generic "server" 
error to be sent by any server for edge case internal errors.

> And, if we are still OK with 403 Forbidden being generated by both origins and intermediaries, it may be helpful to explicitly state that.

Agreed on that.

Amos

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 23 Apr 2013 13:08:16 +1000

On 21/04/2013, at 12:32 PM, Amos Jeffries <[email-masked]> wrote:

> Note: Squid uses 409 Conflict to signal CVE-2009-0801 validation mismatch between DNS, TCP and HTTP state as reason for messages being rejected. It is a client-end error and more expressive of the semantic problem than 400 or 500.

Er, that *really* isn't what 409 means; it's a conflict in the state of the *resource*.

400 and a body / header is probably best for that.

> Disagree strongly with 500. It is intentionally the generic "server" error to be sent by any server for edge case internal errors.

OK, I'll buy that.

>> And, if we are still OK with 403 Forbidden being generated by both origins and intermediaries, it may be helpful to explicitly state that.

OK, it sounds like the outcome here is to note that 403 can be generated by intermediaries, at the most. Let's just make it an editorial suggestion.

Cheers,

---

From: Amos Jeffries <[email-masked]>
Date: Wed, 24 Apr 2013 01:15:51 +1200

On 23/04/2013 3:08 p.m., Mark Nottingham wrote:
> On 21/04/2013, at 12:32 PM, Amos Jeffries wrote:
>

I think it fits. Resource O is being fetched. The information available 
indicates that it is *only* available on server A, B , C. Yet the client 
is fetching a copy from server Z.
  "These droids^W^Wresource is not the one you seek."

> OK, it sounds like the outcome here is to note that 403 can be generated by intermediaries, at the most. Let's just make it an editorial suggestion.

... and what you had in mind for 406 status.

Amos

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 24 Apr 2013 08:20:41 +1000

On 23/04/2013, at 11:15 PM, Amos Jeffries <[email-masked]> wrote:

> I think it fits. Resource O is being fetched. The information available indicates that it is *only* available on server A, B , C. Yet the client is fetching a copy from server Z.

You're confusing a problem with the message (it has conflicting semantics) and the 409 status code's use case -- again, it's about the resource. See <https://svn.tools.ietf.org/svn/wg/httpbis/draft-ietf-httpbis/latest/p2-semantics.html#status.409>.

> ... and what you had in mind for 406 status.

Yes.