Subject: [OAUTH-WG] Improper use of 'Pragma: no-cache' response header in OAuth 2.0 RFCs?

From: Brian Campbell <[email-masked]>
Date: Thu, 19 Feb 2015 16:47:50 -0700

Examples in RFC 6750 <http://tools.ietf.org/html/rfc6750> and RFC 6749
<http://tools.ietf.org/html/rfc6749> as well as some normative text in section
5.1 of RFC 6749 <http://tools.ietf.org/html/rfc6749#section-5.1> use a
"Pragma: no-cache" HTTP response header. However, both RFC 2616
<http://tools.ietf.org/html/rfc2616#section-14.32> and the shiny new RFC
7234 <https://tools.ietf.org/html/rfc7234#section-5.4> make special note
along the lines of the following to say that it doesn't work as response
header:

   'Note: Because the meaning of "Pragma: no-cache" in responses is
    not specified, it does not provide a reliable replacement for
    "Cache-Control: no-cache" in them.'

The header doesn't hurt anything, I don't think, so having it in these
documents isn't really a problem. But it seems like it'd be better to not
further perpetuate the "Pragma: no-cache" response header myth in actual
published RFCs.

So with that said, two questions:

1) Do folks agree that 6747/6750 are using the "Pragma: no-cache" response
header inappropriately?

2) If so, does this qualify as errata?

---

From: Brian Campbell <[email-masked]>
Date: Tue, 24 Feb 2015 10:59:52 -0700

I know it's kind of a trivial issue but I was hoping that at least a couple
people would either agree with me or explain why I'm wrong.

---

From: John Bradley <[email-masked]>
Date: Tue, 24 Feb 2015 13:15:15 -0500

Yes, so we should track it but I don’t think it rises to the level of an errata on its own. 
> On Feb 19, 2015, at 6:47 PM, Brian Campbell <[email-masked]> wrote:
> 
> Examples in RFC 6750 <http://tools.ietf.org/html/rfc6750> and RFC 6749 <http://tools.ietf.org/html/rfc6749> as well as some normative text in section 5.1 of RFC 6749 <http://tools.ietf.org/html/rfc6749#section-5.1> use a "Pragma: no-cache" HTTP response header. However, both RFC 2616 <http://tools.ietf.org/html/rfc2616#section-14.32> and the shiny new RFC 7234 <https://tools.ietf.org/html/rfc7234#section-5.4> make special note along the lines of the following to say that it doesn't work as response header:
> 
> The header doesn't hurt anything, I don't think, so having it in these documents isn't really a problem. But it seems like it'd be better to not further perpetuate the "Pragma: no-cache" response header myth in actual published RFCs.
> 
> 1) Do folks agree that 6747/6750 are using the "Pragma: no-cache" response header inappropriately? 
> 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth