Subject: [quicwg/base-drafts] Clarify client behavior on receiving 421 [http3] (#4934)

From: Erik Nygren <[email-masked]>
Date: Mon, 16 Aug 2021 08:29:43 -0700

While the behavior of servers not wanting to coalesce connections for multiple is specified (SHOULD return 421), the client behavior is not specified.  We should be clear that:

"Clients receiving a 421 MUST retry the request on a different connection that is known to be authoritative for the origin."

Without this, servers lack a way to prevent clients from coalescing or handling misdirected requests.  Some major clients today present 421 as a fatal request error which makes it unsafe for servers to return it.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4934

---

From: Mike Bishop <[email-masked]>
Date: Mon, 16 Aug 2021 08:35:14 -0700

This mostly belongs in http-core, which [does specify](https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#status.421) the following:

> A client that receives a 421 (Misdirected Request) response MAY retry the request, whether or not the request method is idempotent, over a different connection, such as a fresh connection specific to the target resource's origin, or via an alternative service [ALTSVC].

MUST doesn't work because not all clients are browsers.  Some simply return the result without chasing redirects, etc. and leave it to the consumer to decide what to do next.  However, I would have expected at least a SHOULD there.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4934#issuecomment-899607380

---

From: Lucas Pardue <[email-masked]>
Date: Mon, 16 Aug 2021 08:48:36 -0700

Since the H3 specification does include a link section 7.4 of semantics containing a mention of 421, I'm pretty happy with things as they are.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4934#issuecomment-899616656

---

From: Erik Nygren <[email-masked]>
Date: Tue, 17 Aug 2021 16:33:07 -0700

Perhaps we close this out and open an issue against http-semantics to switch to a SHOULD there?  Or maybe if the client got to the origin by following DNS and the SNI == :authority then this is a MAY, but if the client is going to try to coalesce onto a connection it thinks might work then following the 421 should be a MUST?  

Having clients be able to issue requests against any server with a matching cert  (including ones they didn't find via DNS)  without the server having a safe way of telling the client to try again via something it got through DNS isn't really operationally sustainable.  

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4934#issuecomment-900699160

---

From: Mike Bishop <[email-masked]>
Date: Wed, 18 Aug 2021 07:43:30 -0700

I actually had a very similar discussion last week.  All of the redirect status codes also have a MAY for making a request at the new URL, which is conceptually the same.  You're not required to fetch the resource at its new location -- but as a practical matter, if you still want the resource, that's how you'd have to do it because it's not available the first place you asked.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4934#issuecomment-901174688

---

From: Mike Bishop <[email-masked]>
Date: Wed, 18 Aug 2021 07:48:54 -0700

[Semantics 15.4](https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#rfc.section.15.4) does have SHOULD-level guidance for what a client does *when* it is following a redirection.  Perhaps the suggestion should follow that model; you MAY retry, and if you do, the retry SHOULD behave this way....

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4934#issuecomment-901179064