Subject: Re: Server Push and Content Negotiation

From: Mark Nottingham <[email-masked]>
Date: Wed, 7 Sep 2016 13:47:07 +1000

> On 25 Aug 2016, at 12:36 AM, Patrick McManus <[email-masked]> wrote:
> 
> [implementer hat]
> 
> On Wed, Aug 24, 2016 at 12:26 AM, Mark Nottingham <[email-masked]> wrote:
> What do people think -- is this worth specifying? How are implementations currently doing this?
> 
> push is one way - negotiation doesn't make any sense and yet the alternative to negotiation is some kind of sniffing. sniffing is awful and is even harder here where you don't have a request to sniff - you'd have to do some whole connection guess.
> 
> how would you push some feature that relies on conneg today - like webp or brotli?

The server has to make an informed guess about client support. One way would be to look at the initiating request headers; as I think a few people have said, they're rarely variant. Worst case, try a push and look for an error code saying it wasn't a good encoding (see other thread).

> I think as a client realistically you have to wait for the response headers and check them out to see if its an acceptable push. Whatever is in the request headers isn't really enough for that - which is a bit of a change from what I currently do.
> 
> fwiw, this was one of the reasons gzip was a mandatory-to-implement CE in spdy and probably should have stayed. It meant you could reliably push it. Doing so now is really just an assumption that gzip is a defacto standard.
> 
> Or this all might be another argument about the excessive complexity of push - maybe that should be a document :)
> 

--
Mark Nottingham   https://www.mnot.net/

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 7 Sep 2016 13:52:28 +1000

> On 25 Aug 2016, at 3:12 AM, Tom Bergan <[email-masked]> wrote:
> 
> On Tue, Aug 23, 2016 at 9:26 PM, Mark Nottingham <[email-masked]> wrote:
>> The interaction of Content Negotiation and Server Push isn't really specified. Depending on how it's implemented, it could be quite tricky, because it seemingly requires the server to guess what the client would have sent, in order to negotiate upon it.
> 
> This sounds right to me. Though, if the server and client are well-behaved, the worst-case is wasted bandwidth, not an incorrect response:
> - If the server pushes response with a non-empty Vary (or Key) field, it should make a guess for all headers mentioned in Vary (or Key) and include those guesses in the PUSH_PROMISE
> - The client should is match pushed (request, response) pairs to client requests using the Vary (or Key) field in the usual way

Right. One complicating factor is how closely current clients follow <http://httpwg.org/specs/rfc7234.html#caching.negotiated.responses>, versus using their own heuristics.

>> Additionally, the server needs to know what the base capabilities and preferences of the client are, to allow it to select the appropriate responses to push. To aid this, servers SHOULD create a PUSH_PROMISE's request by copying the values of the request header fields mentioned in the `Vary` response header field from the request that is identified by the `PUSH_PROMISE` frame's Stream ID.
> 
> For fields like Accept-Encoding and User-Agent, that's probably sufficient. But in general, it's not quite that simple -- e.g., what if the response has "Vary: Cookie", which can in theory change between requests? You make a similar observation when talking about how Client Hints might change between requests. Also see the discussion for "Rule #4" in this doc:
> https://docs.google.com/document/d/1K0NykTXBbbbTlv60t5MyJvXjqKGsCVNYHyLEXIxYMv0

Don't push something with Vary: Cookie? :)

Otherwise, the client is going to have to get into the business of checking a request to figure out "would I have sent that request?" Making that more complicated is the secondary question, "when?", because things like cookies can change quite quickly.

Client Hints is a bit easier, because AIUI the response is still presumed to be usable by the client, even if the hints don't line up.

>> I'd be tempted to go even further and say that PUSH_PROMISE headers SHOULD NOT contain `DNT`, `User-Agent`, `Cookie` or similar headers UNLESS they were specified in Vary.
> 
> I'd agree with that. I would say that PUSH_PROMISE only needs to contain header fields that describe the cache key of the response (which includes :method, :scheme, :path, :authority, and any header field referenced by Vary or Key).
>  
> Chrome is not doing anything (yet):
> https://bugs.chromium.org/p/chromium/issues/detail?id=554220
> 
> I think most readers come to roughly the same conclusion when reading the RFC, but there is enough uncertainty that I think this is worth specifying in more detail.