Subject: userinfo in :authority

From: Martin Thomson <[email-masked]>
Date: Mon, 6 Jan 2014 11:55:35 -0800

I just closed #334 by prohibiting userinfo in :authority.

https://github.com/http2/http2-spec/issues/334

If anyone thinks that this is a bad idea, and thinks that this needs
to be weaker, discuss.

---

From: Amos Jeffries <[email-masked]>
Date: Tue, 07 Jan 2014 09:23:49 +1300

> If anyone thinks that this is a bad idea, and thinks that this needs

If the HTTP/2 field is going to hold the authority info it rally should 
hold the whole authority info and not encourage eliding details.

Counter to the comment in github, it is only the "user:password" usage 
of userinfo which is deprecated. The field itself is not deprecated and 
is being used in some applications to relay items like Bearer tokens or 
"scheme-specific information about how to gain authorization" in a safer 
way than via query parameter or path.

If it is going to be split off from authority, please document a mapping 
that preserves it for consistency across 1.1->2.0->1.1 gateways.

Amos

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Tue, 07 Jan 2014 13:44:35 +0100

>that preserves it for consistency across 1.1->2.0->1.1 gateways.

It ought to be made clear that this is a non-HTTP feature though, the
use of `userinfo` with `http:` and `https:` has always been disallowed.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Martin Thomson <[email-masked]>
Date: Tue, 7 Jan 2014 11:56:47 -0800

> use of `userinfo` with `http:` and `https:` has always been disallowed.

So, the question is begged: do we want to permit the requesting of
resources identified by URIs other than "http:" or "https:"  I think
that we can, but I'd prefer to add an exception in the form MUST
unless non-http/https if we do, which would allow for those other uses
without opening the door for userinfo in http URIs.

---

From: Patrick McManus <[email-masked]>
Date: Tue, 7 Jan 2014 16:36:06 -0500

+1 on allowing schemes other than http and https.. proxying ftp urls over
http/2 comes to mind as a sorta-common use case.

+1 on MUST NOT userinfo with http and https

---

From: Martin Thomson <[email-masked]>
Date: Tue, 7 Jan 2014 15:40:11 -0800

> http/2 comes to mind as a sorta-common use case.

Done.  Though to be fair, your example is a bad one.  userinfo is bad
for ftp: URIs too.

> +1 on MUST NOT userinfo with http and https

https://github.com/http2/http2-spec/commit/9155bd83bb9e2d6ffa7b667eae0e9de101421d59