Subject: [Uta] MTA-STS and HTTP cache control

From: Daniel Margolis <[email-masked]>
Date: Sun, 20 Aug 2017 14:25:09 +0200

For the policy caching, we deliberately chose not to use HTTP Cache-Control
headers and, instead, use "max_age" in the response body because it avoids
the case where someone is hosting a policy on a general purpose HTTP
endpoint that has some other cache settings than they are aware of. (For
example, I may have an existing website at www.example.com, and I choose to
redirect policy.example.com to www.example.com; I may, additionally, have a
site-wide setting for Cache-Control that I do not have the ability to
change.)

However, by the same logic, it's unclear to me if we should specify to
implementors what their client behavior should be with respect to
Cache-Control--should they honor it as per RFC 7234? Should they never
cache?

As-is, it's up to the sender to cache or not cache (as with any HTTP
client), and thus policy publishers have to be a little careful and
remember that during a forced policy refresh the sender may see an old
policy file up until the Cache-Control forces them not to cache it.

It seems somewhat easier to me to simply specify that HTTP caching should
never be used (i.e. aside from the long-lived policy cache). Any objections?

---

From: Viktor Dukhovni <[email-masked]>
Date: Sun, 20 Aug 2017 09:28:08 -0400

> On Aug 20, 2017, at 8:25 AM, Daniel Margolis <[email-masked]> wrote:
> 
> It seems somewhat easier to me to simply specify that HTTP caching should never be used (i.e. aside from the long-lived policy cache). Any objections?

None, indeed I think that given explicit application-level
caching via max-age, one MUST NOT pay attention to HTTP
cache control.

-- 
	Viktor.

---

From: Daniel Margolis <[email-masked]>
Date: Sun, 20 Aug 2017 19:08:49 +0200

Policies fetched via HTTPS are only valid if the HTTP response code is 200
(OK).
HTTP 3xx redirects MUST NOT be followed, and HTTP caching (as specified in
RFC7234) MUST NOT be used.

On Sun, Aug 20, 2017 at 3:28 PM, Viktor Dukhovni <[email-masked]>
wrote:

> > It seems somewhat easier to me to simply specify that HTTP caching
> should never be used (i.e. aside from the long-lived policy cache). Any
> objections?
>
> _______________________________________________
> Uta mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uta
>

---

From: Viktor Dukhovni <[email-masked]>
Date: Sun, 20 Aug 2017 13:17:26 -0400

> On Aug 20, 2017, at 1:08 PM, Daniel Margolis <[email-masked]> wrote:
> 
> Policies fetched via HTTPS are only valid if the HTTP response code is 200 (OK).

I forget, is non-support of redirects intended to simplify the policy retrieval
code at the sending MTA , or is it a security concern?  I am all for making
the service accessible to bare-bones HTTPS implementations, and so am not asking
for redirect support, just wanted to check the motivation...  Perhaps the rationale
should be stated in the draft?

-- 
	Viktor.