Subject: [Editorial Errata Reported] RFC7230 (5623)

From: RFC Errata System <[email-masked]>
Date: Tue, 5 Feb 2019 08:11:27 -0800 (PST)

The following errata report has been submitted for RFC7230,
"Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata/eid5623

--------------------------------------
Type: Editorial
Reported by: Armin Abfalterer <[email-masked]>

Section: 2.7

Original Text
-------------
absolute-URI  = <absolute-URI, see [RFC3986], Section 4.3>

Corrected Text
--------------

Notes
-----
RFC3986 defines "absolute-URI" very openly, especially regarding to "hier-part":

      absolute-URI  = scheme ":" hier-part [ "?" query ]

      hier-part   = "//" authority path-abempty
                  / path-absolute
                  / path-rootless
                  / path-empty

The impact is reflected in RFC 7231 in the definition of the header fields Referer and Content-Location.

      absolute-URI = <absolute-URI, see [RFC7230], Section 2.7>

Thus, following examples of header values are considered valid

Referer: https:foo/bar
Referer: https:/foo
Referer: https:/
Referer: foo:/

I'd suggest to define "hier-part" (but also "scheme") more strictly.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC7230 (draft-ietf-httpbis-p1-messaging-26)
--------------------------------------
Title               : Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing
Publication Date    : June 2014
Author(s)           : R. Fielding, Ed., J. Reschke, Ed.
Category            : PROPOSED STANDARD
Source              : Hypertext Transfer Protocol Bis APP
Area                : Applications
Stream              : IETF
Verifying Party     : IESG

---

From: Julian Reschke <[email-masked]>
Date: Tue, 5 Feb 2019 17:51:05 +0100

> "Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing".

Why would we want to do that?

-- 
<green/>bytes GmbH, Hafenweg 16, D-48155 Münster, Germany
Amtsgericht Münster: HRB5782

---

From: Julian Reschke <[email-masked]>
Date: Wed, 6 Feb 2019 10:01:13 +0100

On 06.02.2019 08:47, Armin Abfalterer wrote:
> because otherwise unsuspecting developers like me write RFC based validators that don't recognize invalid header values... :)
> ...

Well, they are not invalid per spec.

Apparently you want to make certain things invalid which are valid now. 
This is not what errata are for.

If you want the spec to change, the best way is to describe the problem 
on the HTTP WG's mailing list.

Best regards, Julian