Subject: Semantics of absent header field versus header field with empty value

From: "Backman, Annabelle" <[email-masked]>
Date: Mon, 28 Feb 2022 23:30:28 +0000

In light of the discussion regarding support for absent header fields in HTTP Message Signatures<https://github.com/httpwg/http-extensions/pull/1976>, I'd like to ask the perhaps obvious question: does HTTP permit header fields to make a semantic distinction between the header field being absent from a message, and the header field being present with field value equal to the empty string? If so, are there real-world use cases that people are aware of for this that might help inform that discussion?

Thanks!

—
Annabelle Backman (she/her)
[email-masked]<mailto:[email-masked]>

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 1 Mar 2022 10:57:42 +1100

HTTP permits it, yes. It's considered questionable practice, though, because some implementations might not be able to make the distinction, and/or strip empty fields from the section.

Cheers,

> On 1 Mar 2022, at 10:30 am, Backman, Annabelle <[email-masked]> wrote:
> 
> In light of the discussion regarding support for absent header fields in HTTP Message Signatures, I'd like to ask the perhaps obvious question: does HTTP permit header fields to make a semantic distinction between the header field being absent from a message, and the header field being present with field value equal to the empty string? If so, are there real-world use cases that people are aware of for this that might help inform that discussion?
> 
> Thanks!
> 
> —
> [email-masked]

--
Mark Nottingham   https://www.mnot.net/

---

From: Willy Tarreau <[email-masked]>
Date: Tue, 1 Mar 2022 05:38:35 +0100

Hello Annabelle,

On Mon, Feb 28, 2022 at 11:30:28PM +0000, Backman, Annabelle wrote:
> In light of the discussion regarding support for absent header fields in HTTP
> Message Signatures<https://github.com/httpwg/http-extensions/pull/1976>, I'd
> like to ask the perhaps obvious question: does HTTP permit header fields to
> make a semantic distinction between the header field being absent from a
> message, and the header field being present with field value equal to the
> empty string? If so, are there real-world use cases that people are aware of
> for this that might help inform that discussion?

We have such an example with the Host header field. Its presence is
mandatory in HTTP/1.1, though if you don't know what value to put in
it, an empty field will often work with plenty of servers and will
give you a response instead of a "400 bad request". There's also
Accept-Encoding (and probably more generally other Accept* though I'm
not sure), where absence means anything is accepted while emptiness
indicates nothing is accepted:

    https://datatracker.ietf.org/doc/html/rfc7231#section-5.3.4

Hoping this helps,
Willy