Subject: Re: [webfinger] Server Response language

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 8 Jul 2013 22:41:35 +0200

On Thu, Dec 20, 2012 at 01:02:59PM -0500,
 Paul E. Jones <[email-masked]> wrote 
 a message of 383 lines which said:

> But there server did find something.  It found the "webfinger"
> resource.  The software that responds to the query has to then
> decided what it returns.  It might be logical to some, but I'd argue
> we need to state this to avoid confusion.

It seems that this thread died without a conclusion? I see nothing in
-15 about the server's return code (all examples are success, with a
200 code). Tim Bray claimed that it should simply follow the standard
rules of HTTP but, as far as I know, there are no standard rules when
/.well-known/webfinger is found *but* the resource is not. 200? 401?
404?

GET /.well-known/webfinger?resource=acct%3ADOESNOTEXIST%40example.com HTTP/1.1

---

From: Will Norris <[email-masked]>
Date: Mon, 8 Jul 2013 14:27:12 -0700

In a webfinger query, the HTTP resource being requested is the full
"/.well-known/webfinger?resource=acct:[email-masked]".  If the host
doesn't have any metadata for "acct:[email-masked]", what else would they
return, aside from a 404?  I agree with Tim that simply referencing HTTP
should be sufficient here.

On Mon, Jul 8, 2013 at 1:41 PM, Stephane Bortzmeyer <[email-masked]>wrote:

> > resource.

But that wasn't the HTTP resource that was requested (unless of course you
*actually* requested just "/.well-known/webfinger").  Section 3.4 of
rfc3986 makes it clear that the query string is part of the resource
identifier (as opposed to rfc2396 which left it somewhat ambiguous)

> The software that responds to the query has to then
> GET /.well-known/webfinger?resource=acct%3ADOESNOTEXIST%40example.comHTTP/1.1
>
> _______________________________________________
> webfinger mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/webfinger
>

---

From: "Paul E. Jones" <[email-masked]>
Date: Tue, 9 Jul 2013 00:03:46 -0400

Stephane,

We used to have explicit language in the document to cover this.  Somehow,
part of it got removed and I do not recall why.  If there is an error, we
still have text that effectively says ...

Up until the -07 version, we had this paragraph:

   If the client queries the WebFinger server and provides a URI for
   which the server has no information, the server MUST return a 404
   status code.

This was in the section "Performing a WebFinger Query".  Some of the
language changed in that section, but this behavior should not be lost.
Should we re-introduce this intent with a paragraph like this?

   If the "resource" parameter is a value for which the server has no
   information, the server MUST indicate that it was unable to match
   the request as per Section 10.4.5 of RFC 2616.

This allows the use of 404 or 410, as appropriate.  I think that is the
right thing to do.

I would suggest we do that and also suggest breaking the last sentence from
the first paragraph from section 4.2 so that it is its own paragraph:

  If the "resource" parameter is absent or malformed, the WebFinger
  resource MUST indicate that the request is bad as per Section 10.4.1
  of RFC 2616 [2].

I would then place the above paragraph after this one.

Paul

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Stephane Bortzmeyer
> Sent: Monday, July 08, 2013 4:42 PM
> To: [email-masked]
> Subject: Re: [webfinger] Server Response language
>

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 10 Jul 2013 08:21:06 +0200

On Mon, Jul 08, 2013 at 02:27:12PM -0700,
 Will Norris <[email-masked]> wrote 
 a message of 103 lines which said:

> doesn't have any metadata for "acct:[email-masked]", what else
> would they return, aside from a 404?

It is far from obvious to me. After all,
<https://willnorris.com/search/ghfdghgdghg> does not return a 404,
neither does
<http://www.amazon.com/s/ref=nb_sb_noss?url=search-alias%3Daps&field-keywords=doesnotexistatall>
I understand the difference with Webfinger (both search engines try to
be helpful to humans and so produce some result explaining there was
no match) but, IMHO, it is a sufficient reason to be explicit in the
RFC.

---

From: 'Stephane Bortzmeyer' <[email-masked]>
Date: Wed, 10 Jul 2013 08:18:43 +0200

On Tue, Jul 09, 2013 at 12:03:46AM -0400,
 Paul E. Jones <[email-masked]> wrote 

> This allows the use of 404 or 410, as appropriate.  I think that is the

An aternative, if people insist that it is clear in RFC 3986 and that
it should not be restated in Webfinger, is to provide an example:

For instance, in the OpenID COnnect example, at the end of 3.1, add:

And if the account does not exist:

     GET /.well-known/webfinger?
            resource=acct%3Adoesnotexist%40example.com&
            rel=http%3A%2F%2Fopenid.net%2Fspecs%2Fconnect%2F1.0%2Fissuer
            HTTP/1.1
     Host: example.com

   The server might respond like this:

     HTTP/1.1 404 Not found
     Access-Control-Allow-Origin: *

   Without a body.

---

From: "Paul E. Jones" <[email-masked]>
Date: Wed, 10 Jul 2013 10:01:00 -0400

Stephane,

I believe anyone writing a web service should understand that proposed
sentence.  We could add it as part of an example, but that text is not
normative.  I believe it would be better to introduce a clear statement in
section 4.2 similar to the way I worded it.  Any suggested changes to the
wording?

Paul

> From: 'Stephane Bortzmeyer' [mailto:[email-masked]]
> Sent: Wednesday, July 10, 2013 2:19 AM
> To: Paul E. Jones
> Cc: [email-masked]