Subject: alt-svc and proxies

From: Piotr Galecki <[email-masked]>
Date: Mon, 4 Jan 2016 03:32:39 +0000

When reviewing the alt-svc draft it is not entirely clear to me from the draft how proxies should process Alt-Svc headers and
how they should behave when a response with the Alt-Svc header is received.
This should be defined.

IMO Alt-Svc header support should be required from proxies going forward.
Proxies should behave in the same/similar way as clients in respect to Alt-Svc headers.
They should cache information about alternative service available
and use the alt service for subsequent requests to origin.
Forward proxies supporting alternative services should also remove Alt-Svc headers
when forwarding a response to client.
This is because the protocol used for the client to proxy connection is defined (by user or WPAD) in proxy configuration settings
and it should not be modified by the alternative service header.

I'd like to propose the following changes:

- change "client" to "client (or intermediary)" in the text throughout the draft wherever appropriate

- possibly to section 2.4 or other add text:
  "Intermediaries when receiving a response with Alt-Svc header SHOULD cache the availability of the alternative service
   and use the alt service when forwarding subsequent requests to the origin,  provided the alternative service information is fresh.
   In order to continue using the user (or WPAD) configured protocol for the client to proxy connection
   forward proxies supporting alternative services SHOULD remove Alt-Svc header when forwarding a response to client."
 
Thanks,
Piotr

---

From: Martin Thomson <[email-masked]>
Date: Mon, 4 Jan 2016 14:50:30 +1100

We've discussed intermediation a lot on this list and concluded that
the current text was adequate.

A proxy in the sense you are concerned about is a client, as you can
see from https://httpwg.github.io/specs/rfc7230.html#operation

A proxy can forward Alt-Svc because clients that are configured to use
a proxy for a request will do so regardless of what they learn about
alternative services:

> A client configured to use a proxy for a given request SHOULD NOT directly connect to an alternative service for this request, but instead route it through that proxy.
-- https://httpwg.github.io/http-extensions/alt-svc.html#switching

---

From: Piotr Galecki <[email-masked]>
Date: Tue, 5 Jan 2016 06:01:55 +0000

Yes, proxy is a client (and server) based on the definition you provided.
That clarifies it, thank you.

Even though it is not required Forward Proxy could still strip Alt-Svc header since the header has no use to user agent
and it could only have undesirable consequences if user-agent incorrectly implements alt services.

The draft does not clarify that origin server should be used for proxy selection.
Perhaps the following would make it more clear?
"A client SHOULD use origin, rather than alternative service, when evaluating configuration rules for proxy selection. If a proxy was selected for a given request the client SHOULD NOT directly connect to an alternative service for this request, but instead route it through that proxy."

________________________________________
From: Martin Thomson [[email-masked]]
Sent: Sunday, January 03, 2016 10:50 PM
To: Piotr Galecki
Cc: HTTP Working Group
Subject: Re: alt-svc and proxies

---

From: Martin Thomson <[email-masked]>
Date: Wed, 6 Jan 2016 11:29:26 +1100

> and it could only have undesirable consequences if user-agent incorrectly implements alt services.

A proxy can (and likely will) strip the header field.  However, we
can't guarantee it.  That's why we have the text I cited.

Other than that, there is nothing we can do about people who decide to
ignore specs and do what they please.

> "A client SHOULD use origin, rather than alternative service, when evaluating configuration rules for proxy selection. If a proxy was selected for a given request the client SHOULD NOT directly con…

That's probably not an improvement.  We don't want to start to create
rules about proxy selection here, which your text does.  And I
actually think that proxy selection might be improved by having an
alt-svc input.