Subject: HTTP/2 examples SHOULD use :authority

From: Alex Rousskov <[email-masked]>
Date: Thu, 1 Dec 2016 09:54:59 -0700

Hello,

    This question is inspired be an interoperability problem between Web
Polygraph benchmark and a [MitM] HTTP/2 proxy. Inside a CONNECT tunnel
to a Polygraph server, Polygraph clients were violating the following
RFC 7540 SHOULD by sending a Host header instead of the :authority
pseudo-header:

>   Clients
>   that generate HTTP/2 requests directly SHOULD use the ":authority"
>   pseudo-header field instead of the Host header field.

When forwarding the requests, the proxy dropped the Host header without
adding :authority... While investigating who is at fault, I noticed that
Polygraph [accidentally] follows RFC 7540 examples: *All* Section 8.3
examples show HTTP/2 requests with a Host header instead of :authority!

> GET /resource HTTP/1.1       HEADERS
> Host: example.org       ==>    + END_STREAM
> Accept: image/jpeg             + END_HEADERS
>                                  :method = GET
>                                  :scheme = https
>                                  :path = /resource
>                                  host = example.org
>                                  accept = image/jpeg

One could argue that the RFC examples are meant to illustrate how to
mechanically translate an HTTP/1 message to HTTP/2, with as little
information loss as possible, even at the expense of violating a SHOULD.
I do not think that is a valid argument because the Examples section
does not disclose that intent and most readers will expect the [only]
Example section to illustrate genuine HTTP/2 messages rather than
unusual HTTP version translation peculiarities (unless explicitly noted
otherwise).

AFAICT, the Examples section talks about and shows various generated
HTTP/2 messages that meet version-agnostic prose specifications. The
HTTP/1 messages are probably also included just because most [early] RFC
readers were expected to be more familiar with HTTP/1 than HTTP/2.

Do you think the RFC examples should use ":authority" instead of "host"?

Thank you,

Alex.

---

From: Kari Hurtta <[email-masked]>
Date: Thu, 1 Dec 2016 20:04:50 +0200 (EET)

https://tools.ietf.org/html/rfc7540#section-8.1.2.3

|   o  The ":authority" pseudo-header field includes the authority
|      portion of the target URI ([RFC3986], Section 3.2).  The authority
|      MUST NOT include the deprecated "userinfo" subcomponent for "http"
|      or "https" schemed URIs.
|
|      To ensure that the HTTP/1.1 request line can be reproduced
|      accurately, this pseudo-header field MUST be omitted when
|      translating from an HTTP/1.1 request that has a request target in
|      origin or asterisk form (see [RFC7230], Section 5.3). 

There is "MUST be omitted"

https://tools.ietf.org/html/rfc7230#section-5.3.1

| 5.3.1.  origin-form
| 
|   The most common form of request-target is the origin-form.
|
|     origin-form    = absolute-path [ "?" query ]

> Do you think the RFC examples should use ":authority" instead of "host"?

There should be "native" http/2 only examples also. 

Now these are HTTP/1.1 to HTTP/2 conversion examples,
where ":authority" is not allowed.

/ Kari Hurtta

---

From: Alex Rousskov <[email-masked]>
Date: Thu, 1 Dec 2016 11:26:23 -0700

On 12/01/2016 11:04 AM, Kari Hurtta wrote:

> these are HTTP/1.1 to HTTP/2 conversion examples

IMHO, the current text of the RFC Examples section hides this assumption
well. If your assumption is correct, then this is worth an Errata entry
to add some kind of "these are message translation examples only; most
real HTTP/2 messages are formed differently" warning at the top of that
section.

> There should be "native" http/2 only examples also. 

Agreed. Unfortunately, the lack of examples is not something that is
appropriate to fix via Errata, I guess.

Thank you,

Alex.

---

From: Martin Thomson <[email-masked]>
Date: Fri, 2 Dec 2016 10:08:50 +1100

Alex, you are right to observe that the examples in the document could
have been better.

There was a long discussion about this and the ultimate conclusion was
to recommend :authority over host.  However that never made the
examples section.

We did not mandate use of :authority so that proxies and gateways
could provide perfect fidelity in their translation from 1.1 to 2.

If you interpret the examples as conversions, then they are correct in
that the fidelity is preserved (as Kari points out).  However, I don't
believe that to be the primary purpose of examples in this
specification.

If we were able to make a change, I would indeed change the examples
to use :authority, but include a note that said that - in the case of
a direct conversion from 1.1 - "host" would be used instead.

---

From: Alex Rousskov <[email-masked]>
Date: Thu, 1 Dec 2016 16:19:03 -0700

> could provide perfect fidelity in their translation from 1.1 to 2.

Yes, I suspect I have read most of that [enlightening!] discussion
before posting here and probably understand the origins of these problems.

> a direct conversion from 1.1 - "host" would be used instead.

I believe we are on the same page. If there is a consensus that this
problem deserves an errata, I would be happy to propose a specific
change. Otherwise, this email thread itself may help those confused by
the examples.

Thank you,

Alex.

---

From: Martin Thomson <[email-masked]>
Date: Fri, 2 Dec 2016 11:04:49 +1100

> change. Otherwise, this email thread itself may help those confused by

I can't speak for others, but I wouldn't be opposed to an erratum that
suggested the change I described.