Subject: Re: [httpwg/http-extensions] Impact of Combining headers (#504)

From: HTTP issue updates <[email-masked]>
Date: Wed, 28 Mar 2018 06:21:49 +0000 (UTC)

I think the right answer here is to adjust the text to say that splitting structures across headers can lead to unpredictable/unfortunate results.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/504#issuecomment-376775121

---

From: HTTP issue updates <[email-masked]>
Date: Tue, 27 Mar 2018 23:24:26 -0700

The other approach would be to require commas to be escaped in strings.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/504#issuecomment-376775619

---

From: HTTP issue updates <[email-masked]>
Date: Wed, 28 Mar 2018 06:42:22 +0000 (UTC)

It would be really nice if we defined an operation that basically gets the value of a particular header for an entire header list.

And then once and for all defined what happens with duplicates, relative order, etc.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/504#issuecomment-376778945

---

From: HTTP issue updates <[email-masked]>
Date: Wed, 28 Mar 2018 06:45:22 +0000 (UTC)

To clarify, having syntax for header values is great, but if we don't deal with multiple headers, we'll continue to have a large set of problems we have with the current setup. Do you use the first or last? Do you combine and then parse? Do you parse independently and then use the resulting values? Do you error on multiple headers? By ignoring it or treating it as a network error?

(I've seen most of these trying to figure out how existing headers are implemented.)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/504#issuecomment-376779542

---

From: HTTP issue updates <[email-masked]>
Date: Tue, 27 Mar 2018 23:53:55 -0700

Anne, I think we've got that covered. The question here is whether a string split over multiple headers should be silently handled (including the comma, I suppose), or reliably raise an error.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/504#issuecomment-376781316

---

From: HTTP issue updates <[email-masked]>
Date: Wed, 28 Mar 2018 07:05:56 +0000 (UTC)

Thanks (I'm assuming it's covered somewhere that "field value" is obtained after stripping whitespace).

Since intermediaries can combine, you cannot really disallow it, can you?

I think that's why some folks defining headers try to outlaw the comma I think; so they can detect header injection.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/504#issuecomment-376783784

---

From: HTTP issue updates <[email-masked]>
Date: Fri, 30 Mar 2018 00:48:18 +0000 (UTC)

The easiest way to make it reliably raise an error would be to require commas to be escaped in strings. Would that be offensive?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/504#issuecomment-377414331