draft-ietf-httpbis-messaging-12.txt   draft-ietf-httpbis-messaging-13.txt 
HTTP Working Group R. Fielding, Ed. HTTP Working Group R. Fielding, Ed.
Internet-Draft Adobe Internet-Draft Adobe
Obsoletes: 7230 (if approved) M. Nottingham, Ed. Obsoletes: 7230 (if approved) M. Nottingham, Ed.
Intended status: Standards Track Fastly Intended status: Standards Track Fastly
Expires: April 5, 2021 J. Reschke, Ed. Expires: June 17, 2021 J. Reschke, Ed.
greenbytes greenbytes
October 2, 2020 December 14, 2020
HTTP/1.1 Messaging HTTP/1.1
draft-ietf-httpbis-messaging-12 draft-ietf-httpbis-messaging-13
Abstract Abstract
The Hypertext Transfer Protocol (HTTP) is a stateless application- The Hypertext Transfer Protocol (HTTP) is a stateless application-
level protocol for distributed, collaborative, hypertext information level protocol for distributed, collaborative, hypertext information
systems. This document specifies the HTTP/1.1 message syntax, systems. This document specifies the HTTP/1.1 message syntax,
message parsing, connection management, and related security message parsing, connection management, and related security
concerns. concerns.
This document obsoletes portions of RFC 7230. This document obsoletes portions of RFC 7230.
skipping to change at page 1, line 36 skipping to change at page 1, line 36
This note is to be removed before publishing as an RFC. This note is to be removed before publishing as an RFC.
Discussion of this draft takes place on the HTTP working group Discussion of this draft takes place on the HTTP working group
mailing list (ietf-http-wg@w3.org), which is archived at mailing list (ietf-http-wg@w3.org), which is archived at
<https://lists.w3.org/Archives/Public/ietf-http-wg/>. <https://lists.w3.org/Archives/Public/ietf-http-wg/>.
Working Group information can be found at <https://httpwg.org/>; Working Group information can be found at <https://httpwg.org/>;
source code and issues list for this draft can be found at source code and issues list for this draft can be found at
<https://github.com/httpwg/http-core>. <https://github.com/httpwg/http-core>.
The changes in this draft are summarized in Appendix D.13. The changes in this draft are summarized in Appendix D.14.
Status of This Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79. provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/. Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on April 5, 2021. This Internet-Draft will expire on June 17, 2021.
Copyright Notice Copyright Notice
Copyright (c) 2020 IETF Trust and the persons identified as the Copyright (c) 2020 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/ Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document. license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights Please review these documents carefully, as they describe your rights
skipping to change at page 3, line 9 skipping to change at page 3, line 9
3.1. Method . . . . . . . . . . . . . . . . . . . . . . . . . 10 3.1. Method . . . . . . . . . . . . . . . . . . . . . . . . . 10
3.2. Request Target . . . . . . . . . . . . . . . . . . . . . 10 3.2. Request Target . . . . . . . . . . . . . . . . . . . . . 10
3.2.1. origin-form . . . . . . . . . . . . . . . . . . . . . 11 3.2.1. origin-form . . . . . . . . . . . . . . . . . . . . . 11
3.2.2. absolute-form . . . . . . . . . . . . . . . . . . . . 11 3.2.2. absolute-form . . . . . . . . . . . . . . . . . . . . 11
3.2.3. authority-form . . . . . . . . . . . . . . . . . . . 12 3.2.3. authority-form . . . . . . . . . . . . . . . . . . . 12
3.2.4. asterisk-form . . . . . . . . . . . . . . . . . . . . 12 3.2.4. asterisk-form . . . . . . . . . . . . . . . . . . . . 12
3.3. Reconstructing the Target URI . . . . . . . . . . . . . . 13 3.3. Reconstructing the Target URI . . . . . . . . . . . . . . 13
4. Status Line . . . . . . . . . . . . . . . . . . . . . . . . . 14 4. Status Line . . . . . . . . . . . . . . . . . . . . . . . . . 14
5. Field Syntax . . . . . . . . . . . . . . . . . . . . . . . . 15 5. Field Syntax . . . . . . . . . . . . . . . . . . . . . . . . 15
5.1. Field Line Parsing . . . . . . . . . . . . . . . . . . . 16 5.1. Field Line Parsing . . . . . . . . . . . . . . . . . . . 16
5.2. Obsolete Line Folding . . . . . . . . . . . . . . . . . . 17 5.2. Obsolete Line Folding . . . . . . . . . . . . . . . . . . 16
6. Message Body . . . . . . . . . . . . . . . . . . . . . . . . 17 6. Message Body . . . . . . . . . . . . . . . . . . . . . . . . 17
6.1. Transfer-Encoding . . . . . . . . . . . . . . . . . . . . 18 6.1. Transfer-Encoding . . . . . . . . . . . . . . . . . . . . 17
6.2. Content-Length . . . . . . . . . . . . . . . . . . . . . 19 6.2. Content-Length . . . . . . . . . . . . . . . . . . . . . 19
6.3. Message Body Length . . . . . . . . . . . . . . . . . . . 20 6.3. Message Body Length . . . . . . . . . . . . . . . . . . . 19
7. Transfer Codings . . . . . . . . . . . . . . . . . . . . . . 22 7. Transfer Codings . . . . . . . . . . . . . . . . . . . . . . 22
7.1. Chunked Transfer Coding . . . . . . . . . . . . . . . . . 23 7.1. Chunked Transfer Coding . . . . . . . . . . . . . . . . . 22
7.1.1. Chunk Extensions . . . . . . . . . . . . . . . . . . 24 7.1.1. Chunk Extensions . . . . . . . . . . . . . . . . . . 23
7.1.2. Chunked Trailer Section . . . . . . . . . . . . . . . 25 7.1.2. Chunked Trailer Section . . . . . . . . . . . . . . . 23
7.1.3. Decoding Chunked . . . . . . . . . . . . . . . . . . 25 7.1.3. Decoding Chunked . . . . . . . . . . . . . . . . . . 24
7.2. Transfer Codings for Compression . . . . . . . . . . . . 26 7.2. Transfer Codings for Compression . . . . . . . . . . . . 24
7.3. Transfer Coding Registry . . . . . . . . . . . . . . . . 26 7.3. Transfer Coding Registry . . . . . . . . . . . . . . . . 25
7.4. Negotiating Transfer Codings . . . . . . . . . . . . . . 27 7.4. Negotiating Transfer Codings . . . . . . . . . . . . . . 25
8. Handling Incomplete Messages . . . . . . . . . . . . . . . . 27 8. Handling Incomplete Messages . . . . . . . . . . . . . . . . 26
9. Connection Management . . . . . . . . . . . . . . . . . . . . 28 9. Connection Management . . . . . . . . . . . . . . . . . . . . 27
9.1. Establishment . . . . . . . . . . . . . . . . . . . . . . 28 9.1. Establishment . . . . . . . . . . . . . . . . . . . . . . 27
9.2. Associating a Response to a Request . . . . . . . . . . . 29 9.2. Associating a Response to a Request . . . . . . . . . . . 28
9.3. Persistence . . . . . . . . . . . . . . . . . . . . . . . 29 9.3. Persistence . . . . . . . . . . . . . . . . . . . . . . . 28
9.3.1. Retrying Requests . . . . . . . . . . . . . . . . . . 30 9.3.1. Retrying Requests . . . . . . . . . . . . . . . . . . 29
9.3.2. Pipelining . . . . . . . . . . . . . . . . . . . . . 30 9.3.2. Pipelining . . . . . . . . . . . . . . . . . . . . . 29
9.4. Concurrency . . . . . . . . . . . . . . . . . . . . . . . 31 9.4. Concurrency . . . . . . . . . . . . . . . . . . . . . . . 30
9.5. Failures and Timeouts . . . . . . . . . . . . . . . . . . 32 9.5. Failures and Timeouts . . . . . . . . . . . . . . . . . . 31
9.6. Tear-down . . . . . . . . . . . . . . . . . . . . . . . . 32 9.6. Tear-down . . . . . . . . . . . . . . . . . . . . . . . . 31
9.7. TLS Connection Initiation . . . . . . . . . . . . . . . . 34 9.7. TLS Connection Initiation . . . . . . . . . . . . . . . . 33
9.8. TLS Connection Closure . . . . . . . . . . . . . . . . . 34 9.8. TLS Connection Closure . . . . . . . . . . . . . . . . . 33
10. Enclosing Messages as Data . . . . . . . . . . . . . . . . . 35 10. Enclosing Messages as Data . . . . . . . . . . . . . . . . . 34
10.1. Media Type message/http . . . . . . . . . . . . . . . . 35 10.1. Media Type message/http . . . . . . . . . . . . . . . . 34
10.2. Media Type application/http . . . . . . . . . . . . . . 36 10.2. Media Type application/http . . . . . . . . . . . . . . 35
11. Security Considerations . . . . . . . . . . . . . . . . . . . 37 11. Security Considerations . . . . . . . . . . . . . . . . . . . 36
11.1. Response Splitting . . . . . . . . . . . . . . . . . . . 37 11.1. Response Splitting . . . . . . . . . . . . . . . . . . . 36
11.2. Request Smuggling . . . . . . . . . . . . . . . . . . . 38 11.2. Request Smuggling . . . . . . . . . . . . . . . . . . . 37
11.3. Message Integrity . . . . . . . . . . . . . . . . . . . 38 11.3. Message Integrity . . . . . . . . . . . . . . . . . . . 38
11.4. Message Confidentiality . . . . . . . . . . . . . . . . 39 11.4. Message Confidentiality . . . . . . . . . . . . . . . . 38
12. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 39 12. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 38
12.1. Field Name Registration . . . . . . . . . . . . . . . . 39 12.1. Field Name Registration . . . . . . . . . . . . . . . . 39
12.2. Media Type Registration . . . . . . . . . . . . . . . . 39 12.2. Media Type Registration . . . . . . . . . . . . . . . . 39
12.3. Transfer Coding Registration . . . . . . . . . . . . . . 40 12.3. Transfer Coding Registration . . . . . . . . . . . . . . 39
12.4. ALPN Protocol ID Registration . . . . . . . . . . . . . 40 12.4. ALPN Protocol ID Registration . . . . . . . . . . . . . 40
13. References . . . . . . . . . . . . . . . . . . . . . . . . . 40 13. References . . . . . . . . . . . . . . . . . . . . . . . . . 40
13.1. Normative References . . . . . . . . . . . . . . . . . . 40 13.1. Normative References . . . . . . . . . . . . . . . . . . 40
13.2. Informative References . . . . . . . . . . . . . . . . . 41 13.2. Informative References . . . . . . . . . . . . . . . . . 42
Appendix A. Collected ABNF . . . . . . . . . . . . . . . . . . . 43 Appendix A. Collected ABNF . . . . . . . . . . . . . . . . . . . 43
Appendix B. Differences between HTTP and MIME . . . . . . . . . 44 Appendix B. Differences between HTTP and MIME . . . . . . . . . 45
B.1. MIME-Version . . . . . . . . . . . . . . . . . . . . . . 45 B.1. MIME-Version . . . . . . . . . . . . . . . . . . . . . . 45
B.2. Conversion to Canonical Form . . . . . . . . . . . . . . 45 B.2. Conversion to Canonical Form . . . . . . . . . . . . . . 45
B.3. Conversion of Date Formats . . . . . . . . . . . . . . . 45 B.3. Conversion of Date Formats . . . . . . . . . . . . . . . 46
B.4. Conversion of Content-Encoding . . . . . . . . . . . . . 46 B.4. Conversion of Content-Encoding . . . . . . . . . . . . . 46
B.5. Conversion of Content-Transfer-Encoding . . . . . . . . . 46 B.5. Conversion of Content-Transfer-Encoding . . . . . . . . . 46
B.6. MHTML and Line Length Limitations . . . . . . . . . . . . 46 B.6. MHTML and Line Length Limitations . . . . . . . . . . . . 46
Appendix C. HTTP Version History . . . . . . . . . . . . . . . . 46 Appendix C. Changes from previous RFCs . . . . . . . . . . . . . 47
C.1. Changes from HTTP/1.0 . . . . . . . . . . . . . . . . . . 47 C.1. Changes from HTTP/0.9 . . . . . . . . . . . . . . . . . . 47
C.1.1. Multihomed Web Servers . . . . . . . . . . . . . . . 47 C.2. Changes from HTTP/1.0 . . . . . . . . . . . . . . . . . . 47
C.1.2. Keep-Alive Connections . . . . . . . . . . . . . . . 48 C.2.1. Multihomed Web Servers . . . . . . . . . . . . . . . 47
C.1.3. Introduction of Transfer-Encoding . . . . . . . . . . 48 C.2.2. Keep-Alive Connections . . . . . . . . . . . . . . . 47
C.2. Changes from RFC 7230 . . . . . . . . . . . . . . . . . . 49 C.2.3. Introduction of Transfer-Encoding . . . . . . . . . . 48
C.3. Changes from RFC 7230 . . . . . . . . . . . . . . . . . . 48
Appendix D. Change Log . . . . . . . . . . . . . . . . . . . . . 49 Appendix D. Change Log . . . . . . . . . . . . . . . . . . . . . 49
D.1. Between RFC7230 and draft 00 . . . . . . . . . . . . . . 49 D.1. Between RFC7230 and draft 00 . . . . . . . . . . . . . . 49
D.2. Since draft-ietf-httpbis-messaging-00 . . . . . . . . . . 50 D.2. Since draft-ietf-httpbis-messaging-00 . . . . . . . . . . 49
D.3. Since draft-ietf-httpbis-messaging-01 . . . . . . . . . . 50 D.3. Since draft-ietf-httpbis-messaging-01 . . . . . . . . . . 49
D.4. Since draft-ietf-httpbis-messaging-02 . . . . . . . . . . 51 D.4. Since draft-ietf-httpbis-messaging-02 . . . . . . . . . . 50
D.5. Since draft-ietf-httpbis-messaging-03 . . . . . . . . . . 51 D.5. Since draft-ietf-httpbis-messaging-03 . . . . . . . . . . 50
D.6. Since draft-ietf-httpbis-messaging-04 . . . . . . . . . . 51 D.6. Since draft-ietf-httpbis-messaging-04 . . . . . . . . . . 51
D.7. Since draft-ietf-httpbis-messaging-05 . . . . . . . . . . 52 D.7. Since draft-ietf-httpbis-messaging-05 . . . . . . . . . . 51
D.8. Since draft-ietf-httpbis-messaging-06 . . . . . . . . . . 52 D.8. Since draft-ietf-httpbis-messaging-06 . . . . . . . . . . 52
D.9. Since draft-ietf-httpbis-messaging-07 . . . . . . . . . . 52 D.9. Since draft-ietf-httpbis-messaging-07 . . . . . . . . . . 52
D.10. Since draft-ietf-httpbis-messaging-08 . . . . . . . . . . 53 D.10. Since draft-ietf-httpbis-messaging-08 . . . . . . . . . . 52
D.11. Since draft-ietf-httpbis-messaging-09 . . . . . . . . . . 53 D.11. Since draft-ietf-httpbis-messaging-09 . . . . . . . . . . 52
D.12. Since draft-ietf-httpbis-messaging-10 . . . . . . . . . . 53 D.12. Since draft-ietf-httpbis-messaging-10 . . . . . . . . . . 52
D.13. Since draft-ietf-httpbis-messaging-11 . . . . . . . . . . 53 D.13. Since draft-ietf-httpbis-messaging-11 . . . . . . . . . . 53
D.14. Since draft-ietf-httpbis-messaging-12 . . . . . . . . . . 53
Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . 54 Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . 54
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 54 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 54
1. Introduction 1. Introduction
The Hypertext Transfer Protocol (HTTP) is a stateless application- The Hypertext Transfer Protocol (HTTP) is a stateless application-
level request/response protocol that uses extensible semantics and level request/response protocol that uses extensible semantics and
self-descriptive messages for flexible interaction with network-based self-descriptive messages for flexible interaction with network-based
hypertext information systems. HTTP is defined by a series of hypertext information systems. HTTP/1.1 is defined by:
documents that collectively form the HTTP/1.1 specification:
o This document
o "HTTP Semantics" [Semantics] o "HTTP Semantics" [Semantics]
o "HTTP Caching" [Caching] o "HTTP Caching" [Caching]
o "HTTP/1.1 Messaging" (this document) This document specifies how HTTP semantics are conveyed using the
This document defines HTTP/1.1 message syntax and framing HTTP/1.1 message syntax, framing and connection management
requirements and their associated connection management. Our goal is mechanisms. Its goal is to define the complete set of requirements
to define all of the mechanisms necessary for HTTP/1.1 message for HTTP/1.1 message parsers and message-forwarding intermediaries.
handling that are independent of message semantics, thereby defining
the complete set of requirements for message parsers and message-
forwarding intermediaries.
This document obsoletes the portions of RFC 7230 related to HTTP/1.1 This document obsoletes the portions of RFC 7230 related to HTTP/1.1
messaging and connection management, with the changes being messaging and connection management, with the changes being
summarized in Appendix C.2. The other parts of RFC 7230 are summarized in Appendix C.3. The other parts of RFC 7230 are
obsoleted by "HTTP Semantics" [Semantics]. obsoleted by "HTTP Semantics" [Semantics].
1.1. Requirements Notation 1.1. Requirements Notation
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP "OPTIONAL" in this document are to be interpreted as described in BCP
14 [RFC2119] [RFC8174] when, and only when, they appear in all 14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here. capitals, as shown here.
Conformance criteria and considerations regarding error handling are Conformance criteria and considerations regarding error handling are
defined in Section 2 of [Semantics]. defined in Section 2 of [Semantics].
1.2. Syntax Notation 1.2. Syntax Notation
This specification uses the Augmented Backus-Naur Form (ABNF) This specification uses the Augmented Backus-Naur Form (ABNF)
notation of [RFC5234], extended with the notation for case- notation of [RFC5234], extended with the notation for case-
sensitivity in strings defined in [RFC7405]. sensitivity in strings defined in [RFC7405].
It also uses a list extension, defined in Section 5.7.1 of It also uses a list extension, defined in Section 5.6.1 of
[Semantics], that allows for compact definition of comma-separated [Semantics], that allows for compact definition of comma-separated
lists using a '#' operator (similar to how the '*' operator indicates lists using a '#' operator (similar to how the '*' operator indicates
repetition). Appendix A shows the collected grammar with all list repetition). Appendix A shows the collected grammar with all list
operators expanded to standard ABNF notation. operators expanded to standard ABNF notation.
As a convention, ABNF rule names prefixed with "obs-" denote As a convention, ABNF rule names prefixed with "obs-" denote
"obsolete" grammar rules that appear for historical reasons. "obsolete" grammar rules that appear for historical reasons.
The following core rules are included by reference, as defined in The following core rules are included by reference, as defined in
[RFC5234], Appendix B.1: ALPHA (letters), CR (carriage return), CRLF [RFC5234], Appendix B.1: ALPHA (letters), CR (carriage return), CRLF
(CR LF), CTL (controls), DIGIT (decimal 0-9), DQUOTE (double quote), (CR LF), CTL (controls), DIGIT (decimal 0-9), DQUOTE (double quote),
HEXDIG (hexadecimal 0-9/A-F/a-f), HTAB (horizontal tab), LF (line HEXDIG (hexadecimal 0-9/A-F/a-f), HTAB (horizontal tab), LF (line
feed), OCTET (any 8-bit sequence of data), SP (space), and VCHAR (any feed), OCTET (any 8-bit sequence of data), SP (space), and VCHAR (any
visible [USASCII] character). visible [USASCII] character).
The rules below are defined in [Semantics]: The rules below are defined in [Semantics]:
BWS = <BWS, see [Semantics], Section 5.7.3> BWS = <BWS, see [Semantics], Section 5.6.3>
OWS = <OWS, see [Semantics], Section 5.7.3> OWS = <OWS, see [Semantics], Section 5.6.3>
RWS = <RWS, see [Semantics], Section 5.7.3> RWS = <RWS, see [Semantics], Section 5.6.3>
absolute-URI = <absolute-URI, see [RFC3986], Section 4.3> absolute-URI = <absolute-URI, see [RFC3986], Section 4.3>
absolute-path = <absolute-path, see [Semantics], Section 4> absolute-path = <absolute-path, see [Semantics], Section 4>
authority = <authority, see [RFC3986], Section 3.2> authority = <authority, see [RFC3986], Section 3.2>
comment = <comment, see [Semantics], Section 5.7.5> comment = <comment, see [Semantics], Section 5.6.5>
field-name = <field-name, see [Semantics], Section 5.4.3> field-name = <field-name, see [Semantics], Section 5.1>
field-value = <field-value, see [Semantics], Section 5.4.4> field-value = <field-value, see [Semantics], Section 5.5>
obs-text = <obs-text, see [Semantics], Section 5.7.4> obs-text = <obs-text, see [Semantics], Section 5.6.4>
port = <port, see [RFC3986], Section 3.2.3> port = <port, see [RFC3986], Section 3.2.3>
query = <query, see [RFC3986], Section 3.4> query = <query, see [RFC3986], Section 3.4>
quoted-string = <quoted-string, see [Semantics], Section 5.7.4> quoted-string = <quoted-string, see [Semantics], Section 5.6.4>
token = <token, see [Semantics], Section 5.7.2> token = <token, see [Semantics], Section 5.6.2>
transfer-coding =
<transfer-coding, see [Semantics], Section 10.1.4>
uri-host = <host, see [RFC3986], Section 3.2.2> uri-host = <host, see [RFC3986], Section 3.2.2>
2. Message 2. Message
2.1. Message Format 2.1. Message Format
An HTTP/1.1 message consists of a start-line followed by a CRLF and a An HTTP/1.1 message consists of a start-line followed by a CRLF and a
sequence of octets in a format similar to the Internet Message Format sequence of octets in a format similar to the Internet Message Format
[RFC5322]: zero or more header field lines (collectively referred to [RFC5322]: zero or more header field lines (collectively referred to
as the "headers" or the "header section"), an empty line indicating as the "headers" or the "header section"), an empty line indicating
skipping to change at page 7, line 26 skipping to change at page 7, line 30
encoding that is a superset of US-ASCII [USASCII]. Parsing an HTTP encoding that is a superset of US-ASCII [USASCII]. Parsing an HTTP
message as a stream of Unicode characters, without regard for the message as a stream of Unicode characters, without regard for the
specific encoding, creates security vulnerabilities due to the specific encoding, creates security vulnerabilities due to the
varying ways that string processing libraries handle invalid varying ways that string processing libraries handle invalid
multibyte character sequences that contain the octet LF (%x0A). multibyte character sequences that contain the octet LF (%x0A).
String-based parsers can only be safely used within protocol elements String-based parsers can only be safely used within protocol elements
after the element has been extracted from the message, such as within after the element has been extracted from the message, such as within
a header field line value after message parsing has delineated the a header field line value after message parsing has delineated the
individual field lines. individual field lines.
Although the line terminator for the start-line and header fields is Although the line terminator for the start-line and fields is the
the sequence CRLF, a recipient MAY recognize a single LF as a line sequence CRLF, a recipient MAY recognize a single LF as a line
terminator and ignore any preceding CR. terminator and ignore any preceding CR.
A sender MUST NOT generate a bare CR (a CR character not immediately A sender MUST NOT generate a bare CR (a CR character not immediately
followed by LF) within any protocol elements other than the payload followed by LF) within any protocol elements other than the payload
body. A recipient of such a bare CR MUST consider that element to be data. A recipient of such a bare CR MUST consider that element to be
invalid or replace each bare CR with SP before processing the element invalid or replace each bare CR with SP before processing the element
or forwarding the message. or forwarding the message.
Older HTTP/1.0 user agent implementations might send an extra CRLF Older HTTP/1.0 user agent implementations might send an extra CRLF
after a POST request as a workaround for some early server after a POST request as a workaround for some early server
applications that failed to read message body content that was not applications that failed to read message body content that was not
terminated by a line-ending. An HTTP/1.1 user agent MUST NOT preface terminated by a line-ending. An HTTP/1.1 user agent MUST NOT preface
or follow a request with an extra CRLF. If terminating the request or follow a request with an extra CRLF. If terminating the request
message body with a line-ending is desired, then the user agent MUST message body with a line-ending is desired, then the user agent MUST
count the terminating CRLF octets as part of the message body length. count the terminating CRLF octets as part of the message body length.
skipping to change at page 8, line 31 skipping to change at page 8, line 31
When a server listening only for HTTP request messages, or processing When a server listening only for HTTP request messages, or processing
what appears from the start-line to be an HTTP request message, what appears from the start-line to be an HTTP request message,
receives a sequence of octets that does not match the HTTP-message receives a sequence of octets that does not match the HTTP-message
grammar aside from the robustness exceptions listed above, the server grammar aside from the robustness exceptions listed above, the server
SHOULD respond with a 400 (Bad Request) response. SHOULD respond with a 400 (Bad Request) response.
2.3. HTTP Version 2.3. HTTP Version
HTTP uses a "<major>.<minor>" numbering scheme to indicate versions HTTP uses a "<major>.<minor>" numbering scheme to indicate versions
of the protocol. This specification defines version "1.1". of the protocol. This specification defines version "1.1".
Section 5.1 of [Semantics] specifies the semantics of HTTP version Section 2.5 of [Semantics] specifies the semantics of HTTP version
numbers. numbers.
The version of an HTTP/1.x message is indicated by an HTTP-version The version of an HTTP/1.x message is indicated by an HTTP-version
field in the start-line. HTTP-version is case-sensitive. field in the start-line. HTTP-version is case-sensitive.
HTTP-version = HTTP-name "/" DIGIT "." DIGIT HTTP-version = HTTP-name "/" DIGIT "." DIGIT
HTTP-name = %s"HTTP" HTTP-name = %s"HTTP"
When an HTTP/1.1 message is sent to an HTTP/1.0 recipient [RFC1945] When an HTTP/1.1 message is sent to an HTTP/1.0 recipient [RFC1945]
or a recipient whose version is unknown, the HTTP/1.1 message is or a recipient whose version is unknown, the HTTP/1.1 message is
skipping to change at page 9, line 46 skipping to change at page 9, line 46
(%x0C), or bare CR. However, lenient parsing can result in request (%x0C), or bare CR. However, lenient parsing can result in request
smuggling security vulnerabilities if there are multiple recipients smuggling security vulnerabilities if there are multiple recipients
of the message and each has its own unique interpretation of of the message and each has its own unique interpretation of
robustness (see Section 11.2). robustness (see Section 11.2).
HTTP does not place a predefined limit on the length of a request- HTTP does not place a predefined limit on the length of a request-
line, as described in Section 2 of [Semantics]. A server that line, as described in Section 2 of [Semantics]. A server that
receives a method longer than any that it implements SHOULD respond receives a method longer than any that it implements SHOULD respond
with a 501 (Not Implemented) status code. A server that receives a with a 501 (Not Implemented) status code. A server that receives a
request-target longer than any URI it wishes to parse MUST respond request-target longer than any URI it wishes to parse MUST respond
with a 414 (URI Too Long) status code (see Section 14.5.15 of with a 414 (URI Too Long) status code (see Section 15.5.15 of
[Semantics]). [Semantics]).
Various ad hoc limitations on request-line length are found in Various ad hoc limitations on request-line length are found in
practice. It is RECOMMENDED that all HTTP senders and recipients practice. It is RECOMMENDED that all HTTP senders and recipients
support, at a minimum, request-line lengths of 8000 octets. support, at a minimum, request-line lengths of 8000 octets.
3.1. Method 3.1. Method
The method token indicates the request method to be performed on the The method token indicates the request method to be performed on the
target resource. The request method is case-sensitive. target resource. The request method is case-sensitive.
method = token method = token
The request methods defined by this specification can be found in The request methods defined by this specification can be found in
Section 8 of [Semantics], along with information regarding the HTTP Section 9 of [Semantics], along with information regarding the HTTP
method registry and considerations for defining new methods. method registry and considerations for defining new methods.
3.2. Request Target 3.2. Request Target
The request-target identifies the target resource upon which to apply The request-target identifies the target resource upon which to apply
the request. The client derives a request-target from its desired the request. The client derives a request-target from its desired
target URI. There are four distinct formats for the request-target, target URI. There are four distinct formats for the request-target,
depending on both the method being requested and whether the request depending on both the method being requested and whether the request
is to a proxy. is to a proxy.
skipping to change at page 10, line 51 skipping to change at page 10, line 51
A client MUST send a Host header field in all HTTP/1.1 request A client MUST send a Host header field in all HTTP/1.1 request
messages. If the target URI includes an authority component, then a messages. If the target URI includes an authority component, then a
client MUST send a field value for Host that is identical to that client MUST send a field value for Host that is identical to that
authority component, excluding any userinfo subcomponent and its "@" authority component, excluding any userinfo subcomponent and its "@"
delimiter (Section 4.2.1 of [Semantics]). If the authority component delimiter (Section 4.2.1 of [Semantics]). If the authority component
is missing or undefined for the target URI, then a client MUST send a is missing or undefined for the target URI, then a client MUST send a
Host header field with an empty field value. Host header field with an empty field value.
A server MUST respond with a 400 (Bad Request) status code to any A server MUST respond with a 400 (Bad Request) status code to any
HTTP/1.1 request message that lacks a Host header field and to any HTTP/1.1 request message that lacks a Host header field and to any
request message that contains more than one Host header field or a request message that contains more than one Host header field line or
Host header field with an invalid field value. a Host header field with an invalid field value.
3.2.1. origin-form 3.2.1. origin-form
The most common form of request-target is the origin-form. The most common form of request-target is the _origin-form_.
origin-form = absolute-path [ "?" query ] origin-form = absolute-path [ "?" query ]
When making a request directly to an origin server, other than a When making a request directly to an origin server, other than a
CONNECT or server-wide OPTIONS request (as detailed below), a client CONNECT or server-wide OPTIONS request (as detailed below), a client
MUST send only the absolute path and query components of the target MUST send only the absolute path and query components of the target
URI as the request-target. If the target URI's path component is URI as the request-target. If the target URI's path component is
empty, the client MUST send "/" as the path within the origin-form of empty, the client MUST send "/" as the path within the origin-form of
request-target. A Host header field is also sent, as defined in request-target. A Host header field is also sent, as defined in
Section 6.1.2 of [Semantics]. Section 7.2 of [Semantics].
For example, a client wishing to retrieve a representation of the For example, a client wishing to retrieve a representation of the
resource identified as resource identified as
http://www.example.org/where?q=now http://www.example.org/where?q=now
directly from the origin server would open (or reuse) a TCP directly from the origin server would open (or reuse) a TCP
connection to port 80 of the host "www.example.org" and send the connection to port 80 of the host "www.example.org" and send the
lines: lines:
GET /where?q=now HTTP/1.1 GET /where?q=now HTTP/1.1
Host: www.example.org Host: www.example.org
followed by the remainder of the request message. followed by the remainder of the request message.
3.2.2. absolute-form 3.2.2. absolute-form
When making a request to a proxy, other than a CONNECT or server-wide When making a request to a proxy, other than a CONNECT or server-wide
OPTIONS request (as detailed below), a client MUST send the target OPTIONS request (as detailed below), a client MUST send the target
URI in absolute-form as the request-target. URI in _absolute-form_ as the request-target.
absolute-form = absolute-URI absolute-form = absolute-URI
The proxy is requested to either service that request from a valid The proxy is requested to either service that request from a valid
cache, if possible, or make the same request on the client's behalf cache, if possible, or make the same request on the client's behalf
to either the next inbound proxy server or directly to the origin to either the next inbound proxy server or directly to the origin
server indicated by the request-target. Requirements on such server indicated by the request-target. Requirements on such
"forwarding" of messages are defined in Section 6.4 of [Semantics]. "forwarding" of messages are defined in Section 7.6 of [Semantics].
An example absolute-form of request-line would be: An example absolute-form of request-line would be:
GET http://www.example.org/pub/WWW/TheProject.html HTTP/1.1 GET http://www.example.org/pub/WWW/TheProject.html HTTP/1.1
A client MUST send a Host header field in an HTTP/1.1 request even if A client MUST send a Host header field in an HTTP/1.1 request even if
the request-target is in the absolute-form, since this allows the the request-target is in the absolute-form, since this allows the
Host information to be forwarded through ancient HTTP/1.0 proxies Host information to be forwarded through ancient HTTP/1.0 proxies
that might not have implemented Host. that might not have implemented Host.
skipping to change at page 12, line 31 skipping to change at page 12, line 31
authority component, an empty Host header field will be sent in this authority component, an empty Host header field will be sent in this
case. case.
To allow for transition to the absolute-form for all requests in some To allow for transition to the absolute-form for all requests in some
future version of HTTP, a server MUST accept the absolute-form in future version of HTTP, a server MUST accept the absolute-form in
requests, even though HTTP/1.1 clients will only send them in requests, even though HTTP/1.1 clients will only send them in
requests to proxies. requests to proxies.
3.2.3. authority-form 3.2.3. authority-form
The authority-form of request-target is only used for CONNECT The _authority-form_ of request-target is only used for CONNECT
requests (Section 8.3.6 of [Semantics]). requests (Section 9.3.6 of [Semantics]).
authority-form = authority authority-form = authority
When making a CONNECT request to establish a tunnel through one or When making a CONNECT request to establish a tunnel through one or
more proxies, a client MUST send only the target URI's authority more proxies, a client MUST send only the target URI's authority
component (excluding any userinfo and its "@" delimiter) as the component (excluding any userinfo and its "@" delimiter) as the
request-target. For example, request-target. For example,
CONNECT www.example.com:80 HTTP/1.1 CONNECT www.example.com:80 HTTP/1.1
3.2.4. asterisk-form 3.2.4. asterisk-form
The asterisk-form of request-target is only used for a server-wide The _asterisk-form_ of request-target is only used for a server-wide
OPTIONS request (Section 8.3.7 of [Semantics]). OPTIONS request (Section 9.3.7 of [Semantics]).
asterisk-form = "*" asterisk-form = "*"
When a client wishes to request OPTIONS for the server as a whole, as When a client wishes to request OPTIONS for the server as a whole, as
opposed to a specific named resource of that server, the client MUST opposed to a specific named resource of that server, the client MUST
send only "*" (%x2A) as the request-target. For example, send only "*" (%x2A) as the request-target. For example,
OPTIONS * HTTP/1.1 OPTIONS * HTTP/1.1
If a proxy receives an OPTIONS request with an absolute-form of If a proxy receives an OPTIONS request with an absolute-form of
request-target in which the URI has an empty path and no query request-target in which the URI has an empty path and no query
skipping to change at page 13, line 27 skipping to change at page 13, line 27
OPTIONS * HTTP/1.1 OPTIONS * HTTP/1.1
Host: www.example.org:8001 Host: www.example.org:8001
after connecting to port 8001 of host "www.example.org". after connecting to port 8001 of host "www.example.org".
3.3. Reconstructing the Target URI 3.3. Reconstructing the Target URI
Since the request-target often contains only part of the user agent's Since the request-target often contains only part of the user agent's
target URI, a server constructs its value to properly service the target URI, a server constructs its value to properly service the
request (Section 6.1 of [Semantics]). request (Section 7.1 of [Semantics]).
If the request-target is in absolute-form, the target URI is the same If the request-target is in absolute-form, the target URI is the same
as the request-target. Otherwise, the target URI is constructed as as the request-target. Otherwise, the target URI is constructed as
follows: follows:
o If the server's configuration (or outbound gateway) provides a o If the server's configuration (or outbound gateway) provides a
fixed URI scheme, that scheme is used for the target URI. fixed URI scheme, that scheme is used for the target URI.
Otherwise, if the request is received over a secured connection, Otherwise, if the request is received over a secured connection,
the target URI's scheme is "https"; if not, the scheme is "http". the target URI's scheme is "https"; if not, the scheme is "http".
o If the server's configuration (or outbound gateway) provides a o If the server's configuration (or outbound gateway) provides a
fixed URI authority component, that authority is used for the fixed URI authority component, that authority is used for the
target URI. If not, then if the request-target is in target URI. If not, then if the request-target is in
authority-form, the target URI's authority component is the same authority-form, the target URI's authority component is the same
as the request-target. If not, then if a Host header field is as the request-target. If not, then if a Host header field is
supplied with a non-empty field-value, the authority component is supplied with a non-empty field value, the authority component is
the same as the Host field-value. Otherwise, the authority the same as the Host field value. Otherwise, the authority
component is assigned the default name configured for the server component is assigned the default name configured for the server
and, if the connection's incoming TCP port number differs from the and, if the connection's incoming TCP port number differs from the
default port for the target URI's scheme, then a colon (":") and default port for the target URI's scheme, then a colon (":") and
the incoming port number (in decimal form) are appended to the the incoming port number (in decimal form) are appended to the
authority component. authority component.
o If the request-target is in authority-form or asterisk-form, the o If the request-target is in authority-form or asterisk-form, the
target URI's combined path and query component is empty. target URI's combined path and query component is empty.
Otherwise, the combined path and query component is the same as Otherwise, the combined path and query component is the same as
the request-target. the request-target.
skipping to change at page 15, line 13 skipping to change at page 15, line 13
includes one or more of the following octets: SP, HTAB, VT (%x0B), FF includes one or more of the following octets: SP, HTAB, VT (%x0B), FF
(%x0C), or bare CR. However, lenient parsing can result in response (%x0C), or bare CR. However, lenient parsing can result in response
splitting security vulnerabilities if there are multiple recipients splitting security vulnerabilities if there are multiple recipients
of the message and each has its own unique interpretation of of the message and each has its own unique interpretation of
robustness (see Section 11.1). robustness (see Section 11.1).
The status-code element is a 3-digit integer code describing the The status-code element is a 3-digit integer code describing the
result of the server's attempt to understand and satisfy the client's result of the server's attempt to understand and satisfy the client's
corresponding request. The rest of the response message is to be corresponding request. The rest of the response message is to be
interpreted in light of the semantics defined for that status code. interpreted in light of the semantics defined for that status code.
See Section 14 of [Semantics] for information about the semantics of See Section 15 of [Semantics] for information about the semantics of
status codes, including the classes of status code (indicated by the status codes, including the classes of status code (indicated by the
first digit), the status codes defined by this specification, first digit), the status codes defined by this specification,
considerations for the definition of new status codes, and the IANA considerations for the definition of new status codes, and the IANA
registry. registry.
status-code = 3DIGIT status-code = 3DIGIT
The reason-phrase element exists for the sole purpose of providing a The reason-phrase element exists for the sole purpose of providing a
textual description associated with the numeric status code, mostly textual description associated with the numeric status code, mostly
out of deference to earlier Internet application protocols that were out of deference to earlier Internet application protocols that were
skipping to change at page 15, line 45 skipping to change at page 15, line 45
5. Field Syntax 5. Field Syntax
Each field line consists of a case-insensitive field name followed by Each field line consists of a case-insensitive field name followed by
a colon (":"), optional leading whitespace, the field line value, and a colon (":"), optional leading whitespace, the field line value, and
optional trailing whitespace. optional trailing whitespace.
field-line = field-name ":" OWS field-value OWS field-line = field-name ":" OWS field-value OWS
Most HTTP field names and the rules for parsing within field values Most HTTP field names and the rules for parsing within field values
are defined in Section 5.4 of [Semantics]. This section covers the are defined in Section 6.3 of [Semantics]. This section covers the
generic syntax for header field inclusion within, and extraction generic syntax for header field inclusion within, and extraction
from, HTTP/1.1 messages. In addition, the following header fields from, HTTP/1.1 messages.
are defined by this document because they are specific to HTTP/1.1
message processing:
------------------- ---------- ------
Field Name Status Ref.
------------------- ---------- ------
MIME-Version standard B.1
Transfer-Encoding standard 6.1
------------------- ---------- ------
Table 1
Furthermore, the field name "Close" is reserved, since using that
name as an HTTP header field might conflict with the "close"
connection option of the Connection header field (Section 6.4.1 of
[Semantics]).
------------ ---------- ----------- ------------
Field Name Status Reference Comments
------------ ---------- ----------- ------------
Close standard Section 5 (reserved)
------------ ---------- ----------- ------------
Table 2
5.1. Field Line Parsing 5.1. Field Line Parsing
Messages are parsed using a generic algorithm, independent of the Messages are parsed using a generic algorithm, independent of the
individual field names. The contents within a given field line value individual field names. The contents within a given field line value
are not parsed until a later stage of message interpretation (usually are not parsed until a later stage of message interpretation (usually
after the message's entire header section has been processed). after the message's entire field section has been processed).
No whitespace is allowed between the field name and colon. In the No whitespace is allowed between the field name and colon. In the
past, differences in the handling of such whitespace have led to past, differences in the handling of such whitespace have led to
security vulnerabilities in request routing and response handling. A security vulnerabilities in request routing and response handling. A
server MUST reject any received request message that contains server MUST reject any received request message that contains
whitespace between a header field name and colon with a response whitespace between a header field name and colon with a response
status code of 400 (Bad Request). A proxy MUST remove any such status code of 400 (Bad Request). A proxy MUST remove any such
whitespace from a response message before forwarding the message whitespace from a response message before forwarding the message
downstream. downstream.
A field line value might be preceded and/or followed by optional A field line value might be preceded and/or followed by optional
whitespace (OWS); a single SP preceding the field line value is whitespace (OWS); a single SP preceding the field line value is
preferred for consistent readability by humans. The field line value preferred for consistent readability by humans. The field line value
does not include any leading or trailing whitespace: OWS occurring does not include any leading or trailing whitespace: OWS occurring
before the first non-whitespace octet of the field line value or before the first non-whitespace octet of the field line value or
after the last non-whitespace octet of the field line value ought to after the last non-whitespace octet of the field line value ought to
be excluded by parsers when extracting the field line value from a be excluded by parsers when extracting the field line value from a
header field line. field line.
5.2. Obsolete Line Folding 5.2. Obsolete Line Folding
Historically, HTTP header field line values could be extended over Historically, HTTP field line values could be extended over multiple
multiple lines by preceding each extra line with at least one space lines by preceding each extra line with at least one space or
or horizontal tab (obs-fold). This specification deprecates such horizontal tab (obs-fold). This specification deprecates such line
line folding except within the message/http media type folding except within the message/http media type (Section 10.1).
(Section 10.1).
obs-fold = OWS CRLF RWS obs-fold = OWS CRLF RWS
; obsolete line folding ; obsolete line folding
A sender MUST NOT generate a message that includes line folding A sender MUST NOT generate a message that includes line folding
(i.e., that has any field line value that contains a match to the (i.e., that has any field line value that contains a match to the
obs-fold rule) unless the message is intended for packaging within obs-fold rule) unless the message is intended for packaging within
the message/http media type. the message/http media type.
A server that receives an obs-fold in a request message that is not A server that receives an obs-fold in a request message that is not
skipping to change at page 17, line 43 skipping to change at page 17, line 20
octets prior to interpreting the field value or forwarding the octets prior to interpreting the field value or forwarding the
message downstream. message downstream.
A user agent that receives an obs-fold in a response message that is A user agent that receives an obs-fold in a response message that is
not within a message/http container MUST replace each received not within a message/http container MUST replace each received
obs-fold with one or more SP octets prior to interpreting the field obs-fold with one or more SP octets prior to interpreting the field
value. value.
6. Message Body 6. Message Body
The message body (if any) of an HTTP message is used to carry the The message body (if any) of an HTTP/1.1 message is used to carry
payload body (Section 5.5.4 of [Semantics]) of that request or payload data (Section 6.4 of [Semantics]) for the request or
response. The message body is identical to the payload body unless a response. The message body is identical to the payload data unless a
transfer coding has been applied, as described in Section 6.1. transfer coding has been applied, as described in Section 6.1.
message-body = *OCTET message-body = *OCTET
The rules for determining when a message body is present in an The rules for determining when a message body is present in an
HTTP/1.1 message differ for requests and responses. HTTP/1.1 message differ for requests and responses.
The presence of a message body in a request is signaled by a The presence of a message body in a request is signaled by a
Content-Length or Transfer-Encoding header field. Request message Content-Length or Transfer-Encoding header field. Request message
framing is independent of method semantics, even if the method does framing is independent of method semantics.
not define any use for a message body.
The presence of a message body in a response depends on both the The presence of a message body in a response depends on both the
request method to which it is responding and the response status code request method to which it is responding and the response status code
(Section 4), and corresponds to when a payload body is allowed; see (Section 4), and corresponds to when payload data is allowed; see
Section 5.5.4 of [Semantics]. Section 6.4 of [Semantics].
6.1. Transfer-Encoding 6.1. Transfer-Encoding
The Transfer-Encoding header field lists the transfer coding names The Transfer-Encoding header field lists the transfer coding names
corresponding to the sequence of transfer codings that have been (or corresponding to the sequence of transfer codings that have been (or
will be) applied to the payload body in order to form the message will be) applied to the payload data in order to form the message
body. Transfer codings are defined in Section 7. body. Transfer codings are defined in Section 7.
Transfer-Encoding = #transfer-coding Transfer-Encoding = #transfer-coding
; defined in [Semantics], Section 10.1.4
Transfer-Encoding is analogous to the Content-Transfer-Encoding field Transfer-Encoding is analogous to the Content-Transfer-Encoding field
of MIME, which was designed to enable safe transport of binary data of MIME, which was designed to enable safe transport of binary data
over a 7-bit transport service ([RFC2045], Section 6). However, safe over a 7-bit transport service ([RFC2045], Section 6). However, safe
transport has a different focus for an 8bit-clean transfer protocol. transport has a different focus for an 8bit-clean transfer protocol.
In HTTP's case, Transfer-Encoding is primarily intended to accurately In HTTP's case, Transfer-Encoding is primarily intended to accurately
delimit a dynamically generated payload and to distinguish payload delimit a dynamically generated payload and to distinguish payload
encodings that are only applied for transport efficiency or security encodings that are only applied for transport efficiency or security
from those that are characteristics of the selected resource. from those that are characteristics of the selected resource.
A recipient MUST be able to parse the chunked transfer coding A recipient MUST be able to parse the chunked transfer coding
(Section 7.1) because it plays a crucial role in framing messages (Section 7.1) because it plays a crucial role in framing messages
when the payload body size is not known in advance. A sender MUST when the payload data size is not known in advance. A sender MUST
NOT apply chunked more than once to a message body (i.e., chunking an NOT apply chunked more than once to a message body (i.e., chunking an
already chunked message is not allowed). If any transfer coding already chunked message is not allowed). If any transfer coding
other than chunked is applied to a request payload body, the sender other than chunked is applied to a request's payload data, the sender
MUST apply chunked as the final transfer coding to ensure that the MUST apply chunked as the final transfer coding to ensure that the
message is properly framed. If any transfer coding other than message is properly framed. If any transfer coding other than
chunked is applied to a response payload body, the sender MUST either chunked is applied to a response's payload data, the sender MUST
apply chunked as the final transfer coding or terminate the message either apply chunked as the final transfer coding or terminate the
by closing the connection. message by closing the connection.
For example, For example,
Transfer-Encoding: gzip, chunked Transfer-Encoding: gzip, chunked
indicates that the payload body has been compressed using the gzip indicates that the payload data has been compressed using the gzip
coding and then chunked using the chunked coding while forming the coding and then chunked using the chunked coding while forming the
message body. message body.
Unlike Content-Encoding (Section 7.5.1 of [Semantics]), Transfer- Unlike Content-Encoding (Section 8.5.1 of [Semantics]), Transfer-
Encoding is a property of the message, not of the representation, and Encoding is a property of the message, not of the representation, and
any recipient along the request/response chain MAY decode the any recipient along the request/response chain MAY decode the
received transfer coding(s) or apply additional transfer coding(s) to received transfer coding(s) or apply additional transfer coding(s) to
the message body, assuming that corresponding changes are made to the the message body, assuming that corresponding changes are made to the
Transfer-Encoding field value. Additional information about the Transfer-Encoding field value. Additional information about the
encoding parameters can be provided by other header fields not encoding parameters can be provided by other header fields not
defined by this specification. defined by this specification.
Transfer-Encoding MAY be sent in a response to a HEAD request or in a Transfer-Encoding MAY be sent in a response to a HEAD request or in a
304 (Not Modified) response (Section 14.4.5 of [Semantics]) to a GET 304 (Not Modified) response (Section 15.4.5 of [Semantics]) to a GET
request, neither of which includes a message body, to indicate that request, neither of which includes a message body, to indicate that
the origin server would have applied a transfer coding to the message the origin server would have applied a transfer coding to the message
body if the request had been an unconditional GET. This indication body if the request had been an unconditional GET. This indication
is not required, however, because any recipient on the response chain is not required, however, because any recipient on the response chain
(including the origin server) can remove transfer codings when they (including the origin server) can remove transfer codings when they
are not needed. are not needed.
A server MUST NOT send a Transfer-Encoding header field in any A server MUST NOT send a Transfer-Encoding header field in any
response with a status code of 1xx (Informational) or 204 (No response with a status code of 1xx (Informational) or 204 (No
Content). A server MUST NOT send a Transfer-Encoding header field in Content). A server MUST NOT send a Transfer-Encoding header field in
any 2xx (Successful) response to a CONNECT request (Section 8.3.6 of any 2xx (Successful) response to a CONNECT request (Section 9.3.6 of
[Semantics]). [Semantics]).
Transfer-Encoding was added in HTTP/1.1. It is generally assumed Transfer-Encoding was added in HTTP/1.1. It is generally assumed
that implementations advertising only HTTP/1.0 support will not that implementations advertising only HTTP/1.0 support will not
understand how to process a transfer-encoded payload. A client MUST understand how to process a transfer-encoded payload. A client MUST
NOT send a request containing Transfer-Encoding unless it knows the NOT send a request containing Transfer-Encoding unless it knows the
server will handle HTTP/1.1 requests (or later minor revisions); such server will handle HTTP/1.1 requests (or later minor revisions); such
knowledge might be in the form of specific user configuration or by knowledge might be in the form of specific user configuration or by
remembering the version of a prior received response. A server MUST remembering the version of a prior received response. A server MUST
NOT send a response containing Transfer-Encoding unless the NOT send a response containing Transfer-Encoding unless the
corresponding request indicates HTTP/1.1 (or later minor revisions). corresponding request indicates HTTP/1.1 (or later minor revisions).
A server that receives a request message with a transfer coding it A server that receives a request message with a transfer coding it
does not understand SHOULD respond with 501 (Not Implemented). does not understand SHOULD respond with 501 (Not Implemented).
6.2. Content-Length 6.2. Content-Length
When a message does not have a Transfer-Encoding header field, a When a message does not have a Transfer-Encoding header field, a
Content-Length header field can provide the anticipated size, as a Content-Length header field can provide the anticipated size, as a
decimal number of octets, for a potential payload body. For messages decimal number of octets, for potential payload data. For messages
that do include a payload body, the Content-Length field value that do include payload data, the Content-Length field value provides
provides the framing information necessary for determining where the the framing information necessary for determining where the data (and
body (and message) ends. For messages that do not include a payload message) ends. For messages that do not include payload data, the
body, the Content-Length indicates the size of the selected Content-Length indicates the size of the selected representation
representation (Section 7.7 of [Semantics]). (Section 8.7 of [Semantics]).
| *Note:* HTTP's use of Content-Length for message framing | *Note:* HTTP's use of Content-Length for message framing
| differs significantly from the same field's use in MIME, where | differs significantly from the same field's use in MIME, where
| it is an optional field used only within the "message/external- | it is an optional field used only within the "message/external-
| body" media-type. | body" media-type.
6.3. Message Body Length 6.3. Message Body Length
The length of a message body is determined by one of the following The length of a message body is determined by one of the following
(in order of precedence): (in order of precedence):
1. Any response to a HEAD request and any response with a 1xx 1. Any response to a HEAD request and any response with a 1xx
(Informational), 204 (No Content), or 304 (Not Modified) status (Informational), 204 (No Content), or 304 (Not Modified) status
code is always terminated by the first empty line after the code is always terminated by the first empty line after the
header fields, regardless of the header fields present in the header fields, regardless of the header fields present in the
message, and thus cannot contain a message body. message, and thus cannot contain a message body or trailer
section(s).
2. Any 2xx (Successful) response to a CONNECT request implies that 2. Any 2xx (Successful) response to a CONNECT request implies that
the connection will become a tunnel immediately after the empty the connection will become a tunnel immediately after the empty
line that concludes the header fields. A client MUST ignore any line that concludes the header fields. A client MUST ignore any
Content-Length or Transfer-Encoding header fields received in Content-Length or Transfer-Encoding header fields received in
such a message. such a message.
3. If a Transfer-Encoding header field is present and the chunked 3. If a Transfer-Encoding header field is present and the chunked
transfer coding (Section 7.1) is the final encoding, the message transfer coding (Section 7.1) is the final encoding, the message
body length is determined by reading and decoding the chunked body length is determined by reading and decoding the chunked
skipping to change at page 21, line 4 skipping to change at page 20, line 31
Content-Length. Such a message might indicate an attempt to Content-Length. Such a message might indicate an attempt to
perform request smuggling (Section 11.2) or response splitting perform request smuggling (Section 11.2) or response splitting
(Section 11.1) and ought to be handled as an error. A sender (Section 11.1) and ought to be handled as an error. A sender
MUST remove the received Content-Length field prior to forwarding MUST remove the received Content-Length field prior to forwarding
such a message downstream. such a message downstream.
4. If a message is received without Transfer-Encoding and with an 4. If a message is received without Transfer-Encoding and with an
invalid Content-Length header field, then the message framing is invalid Content-Length header field, then the message framing is
invalid and the recipient MUST treat it as an unrecoverable invalid and the recipient MUST treat it as an unrecoverable
error, unless the field value can be successfully parsed as a error, unless the field value can be successfully parsed as a
comma-separated list (Section 5.7.1 of [Semantics]), all values comma-separated list (Section 5.6.1 of [Semantics]), all values
in the list are valid, and all values in the list are the same. in the list are valid, and all values in the list are the same.
If this is a request message, the server MUST respond with a 400 If this is a request message, the server MUST respond with a 400
(Bad Request) status code and then close the connection. If this (Bad Request) status code and then close the connection. If this
is a response message received by a proxy, the proxy MUST close is a response message received by a proxy, the proxy MUST close
the connection to the server, discard the received response, and the connection to the server, discard the received response, and
send a 502 (Bad Gateway) response to the client. If this is a send a 502 (Bad Gateway) response to the client. If this is a
response message received by a user agent, the user agent MUST response message received by a user agent, the user agent MUST
close the connection to the server and discard the received close the connection to the server and discard the received
response. response.
skipping to change at page 22, line 25 skipping to change at page 21, line 44
A user agent that sends a request containing a message body MUST send A user agent that sends a request containing a message body MUST send
a valid Content-Length header field if it does not know the server a valid Content-Length header field if it does not know the server
will handle HTTP/1.1 (or later) requests; such knowledge can be in will handle HTTP/1.1 (or later) requests; such knowledge can be in
the form of specific user configuration or by remembering the version the form of specific user configuration or by remembering the version
of a prior received response. of a prior received response.
If the final response to the last request on a connection has been If the final response to the last request on a connection has been
completely received and there remains additional data to read, a user completely received and there remains additional data to read, a user
agent MAY discard the remaining data or attempt to determine if that agent MAY discard the remaining data or attempt to determine if that
data belongs as part of the prior response body, which might be the data belongs as part of the prior message body, which might be the
case if the prior message's Content-Length value is incorrect. A case if the prior message's Content-Length value is incorrect. A
client MUST NOT process, cache, or forward such extra data as a client MUST NOT process, cache, or forward such extra data as a
separate response, since such behavior would be vulnerable to cache separate response, since such behavior would be vulnerable to cache
poisoning. poisoning.
7. Transfer Codings 7. Transfer Codings
Transfer coding names are used to indicate an encoding transformation Transfer coding names are used to indicate an encoding transformation
that has been, can be, or might need to be applied to a payload body that has been, can be, or might need to be applied to a payload's
in order to ensure "safe transport" through the network. This data in order to ensure "safe transport" through the network. This
differs from a content coding in that the transfer coding is a differs from a content coding in that the transfer coding is a
property of the message rather than a property of the representation property of the message rather than a property of the representation
that is being transferred. that is being transferred.
transfer-coding = token *( OWS ";" OWS transfer-parameter )
Parameters are in the form of a name=value pair.
transfer-parameter = token BWS "=" BWS ( token / quoted-string )
All transfer-coding names are case-insensitive and ought to be All transfer-coding names are case-insensitive and ought to be
registered within the HTTP Transfer Coding registry, as defined in registered within the HTTP Transfer Coding registry, as defined in
Section 7.3. They are used in the TE (Section 9.1.4 of [Semantics]) Section 7.3. They are used in the Transfer-Encoding (Section 6.1)
and Transfer-Encoding (Section 6.1) header fields. and TE (Section 10.1.4 of [Semantics]) header fields (the latter also
defining the "transfer-coding" grammar).
------------ ------------------------------- -----------
Name Description Reference
------------ ------------------------------- -----------
chunked Transfer in a series of Section
chunks 7.1
compress UNIX "compress" data format Section
[Welch] 7.2
deflate "deflate" compressed data Section
([RFC1951]) inside the "zlib" 7.2
data format ([RFC1950])
gzip GZIP file format [RFC1952] Section
7.2
trailers (reserved) Section 7
x-compress Deprecated (alias for Section
compress) 7.2
x-gzip Deprecated (alias for gzip) Section
7.2
------------ ------------------------------- -----------
Table 3
| *Note:* the coding name "trailers" is reserved because its use
| would conflict with the keyword "trailers" in the TE header
| field (Section 9.1.4 of [Semantics]).
7.1. Chunked Transfer Coding 7.1. Chunked Transfer Coding
The chunked transfer coding wraps the payload body in order to The chunked transfer coding wraps payload data in order to transfer
transfer it as a series of chunks, each with its own size indicator, it as a series of chunks, each with its own size indicator, followed
followed by an OPTIONAL trailer section containing trailer fields. by an OPTIONAL trailer section containing trailer fields. Chunked
Chunked enables content streams of unknown size to be transferred as enables content streams of unknown size to be transferred as a
a sequence of length-delimited buffers, which enables the sender to sequence of length-delimited buffers, which enables the sender to
retain connection persistence and the recipient to know when it has retain connection persistence and the recipient to know when it has
received the entire message. received the entire message.
chunked-body = *chunk chunked-body = *chunk
last-chunk last-chunk
trailer-section trailer-section
CRLF CRLF
chunk = chunk-size [ chunk-ext ] CRLF chunk = chunk-size [ chunk-ext ] CRLF
chunk-data CRLF chunk-data CRLF
skipping to change at page 25, line 9 skipping to change at page 23, line 40
ought to limit the total length of chunk extensions received in a ought to limit the total length of chunk extensions received in a
request to an amount reasonable for the services provided, in the request to an amount reasonable for the services provided, in the
same way that it applies length limitations and timeouts for other same way that it applies length limitations and timeouts for other
parts of a message, and generate an appropriate 4xx (Client Error) parts of a message, and generate an appropriate 4xx (Client Error)
response if that amount is exceeded. response if that amount is exceeded.
7.1.2. Chunked Trailer Section 7.1.2. Chunked Trailer Section
A trailer section allows the sender to include additional fields at A trailer section allows the sender to include additional fields at
the end of a chunked message in order to supply metadata that might the end of a chunked message in order to supply metadata that might
be dynamically generated while the message body is sent, such as a be dynamically generated while the payload data is sent, such as a
message integrity check, digital signature, or post-processing message integrity check, digital signature, or post-processing
status. The proper use and limitations of trailer fields are defined status. The proper use and limitations of trailer fields are defined
in Section 5.6 of [Semantics]. in Section 6.5 of [Semantics].
trailer-section = *( field-line CRLF ) trailer-section = *( field-line CRLF )
A recipient that decodes and removes the chunked encoding from a A recipient that decodes and removes the chunked encoding from a
message (e.g., for storage or forwarding to a non-HTTP/1.1 peer) MUST message (e.g., for storage or forwarding to a non-HTTP/1.1 peer) MUST
discard any received trailer fields, store/forward them separately discard any received trailer fields, store/forward them separately
from the header fields, or selectively merge into the header section from the header fields, or selectively merge into the header section
only those trailer fields corresponding to header field definitions only those trailer fields corresponding to header field definitions
that are understood by the recipient to explicitly permit and define that are understood by the recipient to explicitly permit and define
how their corresponding trailer field value can be safely merged. how their corresponding trailer field value can be safely merged.
7.1.3. Decoding Chunked 7.1.3. Decoding Chunked
A process for decoding the chunked transfer coding can be represented A process for decoding the chunked transfer coding can be represented
in pseudo-code as: in pseudo-code as:
length := 0 length := 0
read chunk-size, chunk-ext (if any), and CRLF read chunk-size, chunk-ext (if any), and CRLF
while (chunk-size > 0) { while (chunk-size > 0) {
read chunk-data and CRLF read chunk-data and CRLF
append chunk-data to decoded-body append chunk-data to payload-data
length := length + chunk-size length := length + chunk-size
read chunk-size, chunk-ext (if any), and CRLF read chunk-size, chunk-ext (if any), and CRLF
} }
read trailer field read trailer field
while (trailer field is not empty) { while (trailer field is not empty) {
if (trailer fields are stored/forwarded separately) { if (trailer fields are stored/forwarded separately) {
append trailer field to existing trailer fields append trailer field to existing trailer fields
} }
else if (trailer field is understood and defined as mergeable) { else if (trailer field is understood and defined as mergeable) {
merge trailer field with existing header fields merge trailer field with existing header fields
skipping to change at page 26, line 11 skipping to change at page 24, line 49
Content-Length := length Content-Length := length
Remove "chunked" from Transfer-Encoding Remove "chunked" from Transfer-Encoding
Remove Trailer from existing header fields Remove Trailer from existing header fields
7.2. Transfer Codings for Compression 7.2. Transfer Codings for Compression
The following transfer coding names for compression are defined by The following transfer coding names for compression are defined by
the same algorithm as their corresponding content coding: the same algorithm as their corresponding content coding:
compress (and x-compress) compress (and x-compress)
See Section 7.5.1.1 of [Semantics]. See Section 8.5.1.1 of [Semantics].
deflate deflate
See Section 7.5.1.2 of [Semantics]. See Section 8.5.1.2 of [Semantics].
gzip (and x-gzip) gzip (and x-gzip)
See Section 7.5.1.3 of [Semantics]. See Section 8.5.1.3 of [Semantics].
The compression codings do not define any parameters. Their presence The compression codings do not define any parameters. Their presence
SHOULD be treated as an error. SHOULD be treated as an error.
7.3. Transfer Coding Registry 7.3. Transfer Coding Registry
The "HTTP Transfer Coding Registry" defines the namespace for The "HTTP Transfer Coding Registry" defines the namespace for
transfer coding names. It is maintained at transfer coding names. It is maintained at
<https://www.iana.org/assignments/http-parameters>. <https://www.iana.org/assignments/http-parameters>.
Registrations MUST include the following fields: Registrations MUST include the following fields:
o Name o Name
o Description o Description
o Pointer to specification text o Pointer to specification text
Names of transfer codings MUST NOT overlap with names of content Names of transfer codings MUST NOT overlap with names of content
codings (Section 7.5.1 of [Semantics]) unless the encoding codings (Section 8.5.1 of [Semantics]) unless the encoding
transformation is identical, as is the case for the compression transformation is identical, as is the case for the compression
codings defined in Section 7.2. codings defined in Section 7.2.
The TE header field (Section 9.1.4 of [Semantics]) uses a pseudo The TE header field (Section 10.1.4 of [Semantics]) uses a pseudo
parameter named "q" as rank value when multiple transfer codings are parameter named "q" as rank value when multiple transfer codings are
acceptable. Future registrations of transfer codings SHOULD NOT acceptable. Future registrations of transfer codings SHOULD NOT
define parameters called "q" (case-insensitively) in order to avoid define parameters called "q" (case-insensitively) in order to avoid
ambiguities. ambiguities.
Values to be added to this namespace require IETF Review (see Values to be added to this namespace require IETF Review (see
Section 4.8 of [RFC8126]), and MUST conform to the purpose of Section 4.8 of [RFC8126]), and MUST conform to the purpose of
transfer coding defined in this specification. transfer coding defined in this specification.
Use of program names for the identification of encoding formats is Use of program names for the identification of encoding formats is
not desirable and is discouraged for future encodings. not desirable and is discouraged for future encodings.
7.4. Negotiating Transfer Codings 7.4. Negotiating Transfer Codings
The TE field (Section 9.1.4 of [Semantics]) is used in HTTP/1.1 to The TE field (Section 10.1.4 of [Semantics]) is used in HTTP/1.1 to
indicate what transfer-codings, besides chunked, the client is indicate what transfer-codings, besides chunked, the client is
willing to accept in the response, and whether or not the client is willing to accept in the response, and whether or not the client is
willing to accept trailer fields in a chunked transfer coding. willing to accept trailer fields in a chunked transfer coding.
A client MUST NOT send the chunked transfer coding name in TE; A client MUST NOT send the chunked transfer coding name in TE;
chunked is always acceptable for HTTP/1.1 recipients. chunked is always acceptable for HTTP/1.1 recipients.
Three examples of TE use are below. Three examples of TE use are below.
TE: deflate TE: deflate
TE: TE:
TE: trailers, deflate;q=0.5 TE: trailers, deflate;q=0.5
When multiple transfer codings are acceptable, the client MAY rank When multiple transfer codings are acceptable, the client MAY rank
the codings by preference using a case-insensitive "q" parameter the codings by preference using a case-insensitive "q" parameter
(similar to the qvalues used in content negotiation fields, (similar to the qvalues used in content negotiation fields,
Section 11.1.1.2 of [Semantics]). The rank value is a real number in Section 12.4.2 of [Semantics]). The rank value is a real number in
the range 0 through 1, where 0.001 is the least preferred and 1 is the range 0 through 1, where 0.001 is the least preferred and 1 is
the most preferred; a value of 0 means "not acceptable". the most preferred; a value of 0 means "not acceptable".
If the TE field value is empty or if no TE field is present, the only If the TE field value is empty or if no TE field is present, the only
acceptable transfer coding is chunked. A message with no transfer acceptable transfer coding is chunked. A message with no transfer
coding is always acceptable. coding is always acceptable.
The keyword "trailers" indicates that the sender will not discard The keyword "trailers" indicates that the sender will not discard
trailer fields, as described in Section 5.6 of [Semantics]. trailer fields, as described in Section 6.5 of [Semantics].
Since the TE header field only applies to the immediate connection, a Since the TE header field only applies to the immediate connection, a
sender of TE MUST also send a "TE" connection option within the sender of TE MUST also send a "TE" connection option within the
Connection header field (Section 6.4.1 of [Semantics]) in order to Connection header field (Section 7.6.1 of [Semantics]) in order to
prevent the TE field from being forwarded by intermediaries that do prevent the TE header field from being forwarded by intermediaries
not support its semantics. that do not support its semantics.
8. Handling Incomplete Messages 8. Handling Incomplete Messages
A server that receives an incomplete request message, usually due to A server that receives an incomplete request message, usually due to
a canceled request or a triggered timeout exception, MAY send an a canceled request or a triggered timeout exception, MAY send an
error response prior to closing the connection. error response prior to closing the connection.
A client that receives an incomplete response message, which can A client that receives an incomplete response message, which can
occur when a connection is closed prematurely or when decoding a occur when a connection is closed prematurely or when decoding a
supposedly chunked transfer coding fails, MUST record the message as supposedly chunked transfer coding fails, MUST record the message as
skipping to change at page 28, line 30 skipping to change at page 27, line 19
9. Connection Management 9. Connection Management
HTTP messaging is independent of the underlying transport- or HTTP messaging is independent of the underlying transport- or
session-layer connection protocol(s). HTTP only presumes a reliable session-layer connection protocol(s). HTTP only presumes a reliable
transport with in-order delivery of requests and the corresponding transport with in-order delivery of requests and the corresponding
in-order delivery of responses. The mapping of HTTP request and in-order delivery of responses. The mapping of HTTP request and
response structures onto the data units of an underlying transport response structures onto the data units of an underlying transport
protocol is outside the scope of this specification. protocol is outside the scope of this specification.
As described in Section 6.2 of [Semantics], the specific connection As described in Section 7.3 of [Semantics], the specific connection
protocols to be used for an HTTP interaction are determined by client protocols to be used for an HTTP interaction are determined by client
configuration and the target URI. For example, the "http" URI scheme configuration and the target URI. For example, the "http" URI scheme
(Section 4.2.1 of [Semantics]) indicates a default connection of TCP (Section 4.2.1 of [Semantics]) indicates a default connection of TCP
over IP, with a default TCP port of 80, but the client might be over IP, with a default TCP port of 80, but the client might be
configured to use a proxy via some other connection, port, or configured to use a proxy via some other connection, port, or
protocol. protocol.
HTTP implementations are expected to engage in connection management, HTTP implementations are expected to engage in connection management,
which includes maintaining the state of current connections, which includes maintaining the state of current connections,
establishing a new connection or reusing an existing connection, establishing a new connection or reusing an existing connection,
skipping to change at page 29, line 13 skipping to change at page 28, line 13
protocols. Each connection applies to only one transport link. protocols. Each connection applies to only one transport link.
9.2. Associating a Response to a Request 9.2. Associating a Response to a Request
HTTP/1.1 does not include a request identifier for associating a HTTP/1.1 does not include a request identifier for associating a
given request message with its corresponding one or more response given request message with its corresponding one or more response
messages. Hence, it relies on the order of response arrival to messages. Hence, it relies on the order of response arrival to
correspond exactly to the order in which requests are made on the correspond exactly to the order in which requests are made on the
same connection. More than one response message per request only same connection. More than one response message per request only
occurs when one or more informational responses (1xx, see occurs when one or more informational responses (1xx, see
Section 14.2 of [Semantics]) precede a final response to the same Section 15.2 of [Semantics]) precede a final response to the same
request. request.
A client that has more than one outstanding request on a connection A client that has more than one outstanding request on a connection
MUST maintain a list of outstanding requests in the order sent and MUST maintain a list of outstanding requests in the order sent and
MUST associate each received response message on that connection to MUST associate each received response message on that connection to
the highest ordered request that has not yet received a final (non- the highest ordered request that has not yet received a final (non-
1xx) response. 1xx) response.
If an HTTP/1.1 client receives data on a connection that doesn't have If an HTTP/1.1 client receives data on a connection that doesn't have
any outstanding requests, it MUST NOT consider them to be a response any outstanding requests, it MUST NOT consider them to be a response
to a not-yet-issued request; it SHOULD close the connection, since to a not-yet-issued request; it SHOULD close the connection, since
message delimitation is now ambiguous, unless the data consists only message delimitation is now ambiguous, unless the data consists only
of one or more CRLF (which can be discarded, as per Section 2.2). of one or more CRLF (which can be discarded, as per Section 2.2).
9.3. Persistence 9.3. Persistence
HTTP/1.1 defaults to the use of "persistent connections", allowing HTTP/1.1 defaults to the use of "_persistent connections_", allowing
multiple requests and responses to be carried over a single multiple requests and responses to be carried over a single
connection. The "close" connection option is used to signal that a connection. The "close" connection option is used to signal that a
connection will not persist after the current request/response. HTTP connection will not persist after the current request/response. HTTP
implementations SHOULD support persistent connections. implementations SHOULD support persistent connections.
A recipient determines whether a connection is persistent or not A recipient determines whether a connection is persistent or not
based on the most recently received message's protocol version and based on the most recently received message's protocol version and
Connection header field (Section 6.4.1 of [Semantics]), if any: Connection header field (Section 7.6.1 of [Semantics]), if any:
o If the "close" connection option is present, the connection will o If the "close" connection option is present, the connection will
not persist after the current response; else, not persist after the current response; else,
o If the received protocol is HTTP/1.1 (or later), the connection o If the received protocol is HTTP/1.1 (or later), the connection
will persist after the current response; else, will persist after the current response; else,
o If the received protocol is HTTP/1.0, the "keep-alive" connection o If the received protocol is HTTP/1.0, the "keep-alive" connection
option is present, either the recipient is not a proxy or the option is present, either the recipient is not a proxy or the
message is a response, and the recipient wishes to honor the message is a response, and the recipient wishes to honor the
skipping to change at page 30, line 30 skipping to change at page 29, line 30
its response, since otherwise the remaining data on a persistent its response, since otherwise the remaining data on a persistent
connection would be misinterpreted as the next request. Likewise, a connection would be misinterpreted as the next request. Likewise, a
client MUST read the entire response message body if it intends to client MUST read the entire response message body if it intends to
reuse the same connection for a subsequent request. reuse the same connection for a subsequent request.
A proxy server MUST NOT maintain a persistent connection with an A proxy server MUST NOT maintain a persistent connection with an
HTTP/1.0 client (see Section 19.7.1 of [RFC2068] for information and HTTP/1.0 client (see Section 19.7.1 of [RFC2068] for information and
discussion of the problems with the Keep-Alive header field discussion of the problems with the Keep-Alive header field
implemented by many HTTP/1.0 clients). implemented by many HTTP/1.0 clients).
See Appendix C.1.2 for more information on backwards compatibility Note that the field name "Close" is reserved, since using that name
as an HTTP header field might conflict with the "close" connection
defined above.
See Appendix C.2.2 for more information on backwards compatibility
with HTTP/1.0 clients. with HTTP/1.0 clients.
9.3.1. Retrying Requests 9.3.1. Retrying Requests
Connections can be closed at any time, with or without intention. Connections can be closed at any time, with or without intention.
Implementations ought to anticipate the need to recover from Implementations ought to anticipate the need to recover from
asynchronous close events. The conditions under which a client can asynchronous close events. The conditions under which a client can
automatically retry a sequence of outstanding requests are defined in automatically retry a sequence of outstanding requests are defined in
Section 8.2.2 of [Semantics]. Section 9.2.2 of [Semantics].
9.3.2. Pipelining 9.3.2. Pipelining
A client that supports persistent connections MAY "pipeline" its A client that supports persistent connections MAY "_pipeline_" its
requests (i.e., send multiple requests without waiting for each requests (i.e., send multiple requests without waiting for each
response). A server MAY process a sequence of pipelined requests in response). A server MAY process a sequence of pipelined requests in
parallel if they all have safe methods (Section 8.2.1 of parallel if they all have safe methods (Section 9.2.1 of
[Semantics]), but it MUST send the corresponding responses in the [Semantics]), but it MUST send the corresponding responses in the
same order that the requests were received. same order that the requests were received.
A client that pipelines requests SHOULD retry unanswered requests if A client that pipelines requests SHOULD retry unanswered requests if
the connection closes before it receives all of the corresponding the connection closes before it receives all of the corresponding
responses. When retrying pipelined requests after a failed responses. When retrying pipelined requests after a failed
connection (a connection not explicitly closed by the server in its connection (a connection not explicitly closed by the server in its
last complete response), a client MUST NOT pipeline immediately after last complete response), a client MUST NOT pipeline immediately after
connection establishment, since the first remaining request in the connection establishment, since the first remaining request in the
prior pipeline might have caused an error response that can be lost prior pipeline might have caused an error response that can be lost
again if multiple requests are sent on a prematurely closed again if multiple requests are sent on a prematurely closed
connection (see the TCP reset problem described in Section 9.6). connection (see the TCP reset problem described in Section 9.6).
Idempotent methods (Section 8.2.2 of [Semantics]) are significant to Idempotent methods (Section 9.2.2 of [Semantics]) are significant to
pipelining because they can be automatically retried after a pipelining because they can be automatically retried after a
connection failure. A user agent SHOULD NOT pipeline requests after connection failure. A user agent SHOULD NOT pipeline requests after
a non-idempotent method, until the final response status code for a non-idempotent method, until the final response status code for
that method has been received, unless the user agent has a means to that method has been received, unless the user agent has a means to
detect and recover from partial failure conditions involving the detect and recover from partial failure conditions involving the
pipelined sequence. pipelined sequence.
An intermediary that receives pipelined requests MAY pipeline those An intermediary that receives pipelined requests MAY pipeline those
requests when forwarding them inbound, since it can rely on the requests when forwarding them inbound, since it can rely on the
outbound user agent(s) to determine what requests can be safely outbound user agent(s) to determine what requests can be safely
skipping to change at page 32, line 42 skipping to change at page 31, line 46
A client sending a message body SHOULD monitor the network connection A client sending a message body SHOULD monitor the network connection
for an error response while it is transmitting the request. If the for an error response while it is transmitting the request. If the
client sees a response that indicates the server does not wish to client sees a response that indicates the server does not wish to
receive the message body and is closing the connection, the client receive the message body and is closing the connection, the client
SHOULD immediately cease transmitting the body and close its side of SHOULD immediately cease transmitting the body and close its side of
the connection. the connection.
9.6. Tear-down 9.6. Tear-down
The Connection header field (Section 6.4.1 of [Semantics]) provides a The Connection header field (Section 7.6.1 of [Semantics]) provides a
"close" connection option that a sender SHOULD send when it wishes to "close" connection option that a sender SHOULD send when it wishes to
close the connection after the current request/response pair. close the connection after the current request/response pair.
A client that sends a "close" connection option MUST NOT send further A client that sends a "close" connection option MUST NOT send further
requests on that connection (after the one containing "close") and requests on that connection (after the one containing "close") and
MUST close the connection after reading the final response message MUST close the connection after reading the final response message
corresponding to this request. corresponding to this request.
A server that receives a "close" connection option MUST initiate a A server that receives a "close" connection option MUST initiate a
close of the connection (see below) after it sends the final response close of the connection (see below) after it sends the final response
skipping to change at page 37, line 33 skipping to change at page 36, line 42
Restrictions on usage: N/A Restrictions on usage: N/A
Author: See Authors' Addresses section. Author: See Authors' Addresses section.
Change controller: IESG Change controller: IESG
11. Security Considerations 11. Security Considerations
This section is meant to inform developers, information providers, This section is meant to inform developers, information providers,
and users of known security considerations relevant to HTTP message and users of known security considerations relevant to HTTP message
syntax, parsing, and routing. Security considerations about HTTP syntax and parsing. Security considerations about HTTP semantics,
semantics and payloads are addressed in [Semantics]. payloads, and routing are addressed in [Semantics].
11.1. Response Splitting 11.1. Response Splitting
Response splitting (a.k.a, CRLF injection) is a common technique, Response splitting (a.k.a, CRLF injection) is a common technique,
used in various attacks on Web usage, that exploits the line-based used in various attacks on Web usage, that exploits the line-based
nature of HTTP message framing and the ordered association of nature of HTTP message framing and the ordered association of
requests to responses on persistent connections [Klein]. This requests to responses on persistent connections [Klein]. This
technique can be particularly damaging when the requests pass through technique can be particularly damaging when the requests pass through
a shared cache. a shared cache.
skipping to change at page 39, line 41 skipping to change at page 39, line 7
confidential connection, as described in Section 4.2.2 of confidential connection, as described in Section 4.2.2 of
[Semantics]. [Semantics].
12. IANA Considerations 12. IANA Considerations
The change controller for the following registrations is: "IETF The change controller for the following registrations is: "IETF
(iesg@ietf.org) - Internet Engineering Task Force". (iesg@ietf.org) - Internet Engineering Task Force".
12.1. Field Name Registration 12.1. Field Name Registration
Please update the "Hypertext Transfer Protocol (HTTP) Field Name First, introduce the new "Hypertext Transfer Protocol (HTTP) Field
Registry" at <https://www.iana.org/assignments/http-fields> with the Name Registry" at <https://www.iana.org/assignments/http-fields> as
field names listed in the two tables of Section 5. described in Section 18.4 of [Semantics].
Then, please update the registry with the field names listed in the
table below:
------------------- ---------- ------ ------------
Field Name Status Ref. Comments
------------------- ---------- ------ ------------
Close standard 9.3 (reserved)
MIME-Version standard B.1
Transfer-Encoding standard 6.1
------------------- ---------- ------ ------------
Table 1
12.2. Media Type Registration 12.2. Media Type Registration
Please update the "Media Types" registry at Please update the "Media Types" registry at
<https://www.iana.org/assignments/media-types> with the registration <https://www.iana.org/assignments/media-types> with the registration
information in Section 10.1 and Section 10.2 for the media types information in Section 10.1 and Section 10.2 for the media types
"message/http" and "application/http", respectively. "message/http" and "application/http", respectively.
12.3. Transfer Coding Registration 12.3. Transfer Coding Registration
Please update the "HTTP Transfer Coding Registry" at Please update the "HTTP Transfer Coding Registry" at
<https://www.iana.org/assignments/http-parameters/> with the <https://www.iana.org/assignments/http-parameters/> with the
registration procedure of Section 7.3 and the content coding names registration procedure of Section 7.3 and the content coding names
summarized in the table of Section 7. summarized in the table below.
------------ ------------------------------- -----------
Name Description Reference
------------ ------------------------------- -----------
chunked Transfer in a series of Section
chunks 7.1
compress UNIX "compress" data format Section
[Welch] 7.2
deflate "deflate" compressed data Section
([RFC1951]) inside the "zlib" 7.2
data format ([RFC1950])
gzip GZIP file format [RFC1952] Section
7.2
trailers (reserved) Section
12.3
x-compress Deprecated (alias for Section
compress) 7.2
x-gzip Deprecated (alias for gzip) Section
7.2
------------ ------------------------------- -----------
Table 2
| *Note:* the coding name "trailers" is reserved because its use
| would conflict with the keyword "trailers" in the TE header
| field (Section 10.1.4 of [Semantics]).
12.4. ALPN Protocol ID Registration 12.4. ALPN Protocol ID Registration
Please update the "TLS Application-Layer Protocol Negotiation (ALPN) Please update the "TLS Application-Layer Protocol Negotiation (ALPN)
Protocol IDs" registry at <https://www.iana.org/assignments/tls- Protocol IDs" registry at <https://www.iana.org/assignments/tls-
extensiontype-values/tls-extensiontype-values.xhtml> with the extensiontype-values/tls-extensiontype-values.xhtml> with the
registration below: registration below:
---------- ----------------------------- ---------------- ---------- ----------------------------- ----------------
Protocol Identification Sequence Reference Protocol Identification Sequence Reference
---------- ----------------------------- ---------------- ---------- ----------------------------- ----------------
HTTP/1.1 0x68 0x74 0x74 0x70 0x2f (this HTTP/1.1 0x68 0x74 0x74 0x70 0x2f (this
0x31 0x2e 0x31 ("http/1.1") specification) 0x31 0x2e 0x31 ("http/1.1") specification)
---------- ----------------------------- ---------------- ---------- ----------------------------- ----------------
Table 4 Table 3
13. References 13. References
13.1. Normative References 13.1. Normative References
[Caching] Fielding, R., Ed., Nottingham, M., Ed., and J. Reschke, [Caching] Fielding, R., Ed., Nottingham, M., Ed., and J. Reschke,
Ed., "HTTP Caching", Work in Progress, Internet-Draft, Ed., "HTTP Caching", Work in Progress, Internet-Draft,
draft-ietf-httpbis-cache-12, October 2, 2020, draft-ietf-httpbis-cache-13, December 14, 2020,
<https://tools.ietf.org/html/draft-ietf-httpbis-cache-12>. <https://tools.ietf.org/html/draft-ietf-httpbis-cache-13>.
[RFC1950] Deutsch, L.P. and J-L. Gailly, "ZLIB Compressed Data [RFC1950] Deutsch, L.P. and J-L. Gailly, "ZLIB Compressed Data
Format Specification version 3.3", RFC 1950, Format Specification version 3.3", RFC 1950,
DOI 10.17487/RFC1950, May 1996, DOI 10.17487/RFC1950, May 1996,
<https://www.rfc-editor.org/info/rfc1950>. <https://www.rfc-editor.org/info/rfc1950>.
[RFC1951] Deutsch, P., "DEFLATE Compressed Data Format Specification [RFC1951] Deutsch, P., "DEFLATE Compressed Data Format Specification
version 1.3", RFC 1951, DOI 10.17487/RFC1951, May 1996, version 1.3", RFC 1951, DOI 10.17487/RFC1951, May 1996,
<https://www.rfc-editor.org/info/rfc1951>. <https://www.rfc-editor.org/info/rfc1951>.
skipping to change at page 41, line 35 skipping to change at page 42, line 8
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>. May 2017, <https://www.rfc-editor.org/info/rfc8174>.
[RFC8446] Rescorla, E., "The Transport Layer Security (TLS) Protocol [RFC8446] Rescorla, E., "The Transport Layer Security (TLS) Protocol
Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018, Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018,
<https://www.rfc-editor.org/info/rfc8446>. <https://www.rfc-editor.org/info/rfc8446>.
[Semantics] [Semantics]
Fielding, R., Ed., Nottingham, M., Ed., and J. Reschke, Fielding, R., Ed., Nottingham, M., Ed., and J. Reschke,
Ed., "HTTP Semantics", Work in Progress, Internet-Draft, Ed., "HTTP Semantics", Work in Progress, Internet-Draft,
draft-ietf-httpbis-semantics-12, October 2, 2020, draft-ietf-httpbis-semantics-13, December 14, 2020,
<https://tools.ietf.org/html/draft-ietf-httpbis-semantics- <https://tools.ietf.org/html/draft-ietf-httpbis-semantics-
12>. 13>.
[USASCII] American National Standards Institute, "Coded Character [USASCII] American National Standards Institute, "Coded Character
Set -- 7-bit American Standard Code for Information Set -- 7-bit American Standard Code for Information
Interchange", ANSI X3.4, 1986. Interchange", ANSI X3.4, 1986.
[Welch] Welch, T. A., "A Technique for High-Performance Data [Welch] Welch, T. A., "A Technique for High-Performance Data
Compression", IEEE Computer 17(6), June 1984. Compression", IEEE Computer 17(6), June 1984.
13.2. Informative References 13.2. Informative References
[Err4667] RFC Errata, Erratum ID 4667, RFC 7230, [Err4667] RFC Errata, Erratum ID 4667, RFC 7230,
<https://www.rfc-editor.org/errata/eid4667>. <https://www.rfc-editor.org/errata/eid4667>.
[Klein] Klein, A., "Divide and Conquer - HTTP Response Splitting, [Klein] Klein, A., "Divide and Conquer - HTTP Response Splitting,
Web Cache Poisoning Attacks, and Related Topics", March Web Cache Poisoning Attacks, and Related Topics", March
2004, <http://packetstormsecurity.com/papers/general/ 2004, <http://packetstormsecurity.com/papers/general/
whitepaper_httpresponse.pdf>. whitepaper_httpresponse.pdf>.
[Linhart] Linhart, C., Klein, A., Heled, R., and S. Orrin, "HTTP [Linhart] Linhart, C., Klein, A., Heled, R., and S. Orrin, "HTTP
Request Smuggling", June 2005, Request Smuggling", June 2005,
<http://www.watchfire.com/news/whitepapers.aspx>. <https://www.cgisecurity.com/lib/HTTP-Request-
Smuggling.pdf>.
[RFC1945] Berners-Lee, T., Fielding, R.T., and H.F. Nielsen, [RFC1945] Berners-Lee, T., Fielding, R.T., and H.F. Nielsen,
"Hypertext Transfer Protocol -- HTTP/1.0", RFC 1945, "Hypertext Transfer Protocol -- HTTP/1.0", RFC 1945,
DOI 10.17487/RFC1945, May 1996, DOI 10.17487/RFC1945, May 1996,
<https://www.rfc-editor.org/info/rfc1945>. <https://www.rfc-editor.org/info/rfc1945>.
[RFC2045] Freed, N. and N.S. Borenstein, "Multipurpose Internet Mail [RFC2045] Freed, N. and N.S. Borenstein, "Multipurpose Internet Mail
Extensions (MIME) Part One: Format of Internet Message Extensions (MIME) Part One: Format of Internet Message
Bodies", RFC 2045, DOI 10.17487/RFC2045, November 1996, Bodies", RFC 2045, DOI 10.17487/RFC2045, November 1996,
<https://www.rfc-editor.org/info/rfc2045>. <https://www.rfc-editor.org/info/rfc2045>.
skipping to change at page 43, line 18 skipping to change at page 43, line 37
<https://www.rfc-editor.org/info/rfc7231>. <https://www.rfc-editor.org/info/rfc7231>.
[RFC8126] Cotton, M., Leiba, B., and T. Narten, "Guidelines for [RFC8126] Cotton, M., Leiba, B., and T. Narten, "Guidelines for
Writing an IANA Considerations Section in RFCs", BCP 26, Writing an IANA Considerations Section in RFCs", BCP 26,
RFC 8126, DOI 10.17487/RFC8126, June 2017, RFC 8126, DOI 10.17487/RFC8126, June 2017,
<https://www.rfc-editor.org/info/rfc8126>. <https://www.rfc-editor.org/info/rfc8126>.
Appendix A. Collected ABNF Appendix A. Collected ABNF
In the collected ABNF below, list rules are expanded as per In the collected ABNF below, list rules are expanded as per
Section 5.7.1.1 of [Semantics]. Section 5.6.1.1 of [Semantics].
BWS = <BWS, see [Semantics], Section 5.7.3> BWS = <BWS, see [Semantics], Section 5.6.3>
HTTP-message = start-line CRLF *( field-line CRLF ) CRLF [ HTTP-message = start-line CRLF *( field-line CRLF ) CRLF [
message-body ] message-body ]
HTTP-name = %x48.54.54.50 ; HTTP HTTP-name = %x48.54.54.50 ; HTTP
HTTP-version = HTTP-name "/" DIGIT "." DIGIT HTTP-version = HTTP-name "/" DIGIT "." DIGIT
OWS = <OWS, see [Semantics], Section 5.7.3> OWS = <OWS, see [Semantics], Section 5.6.3>
RWS = <RWS, see [Semantics], Section 5.7.3> RWS = <RWS, see [Semantics], Section 5.6.3>
Transfer-Encoding = [ transfer-coding *( OWS "," OWS transfer-coding Transfer-Encoding = [ transfer-coding *( OWS "," OWS transfer-coding
) ] ) ]
absolute-URI = <absolute-URI, see [RFC3986], Section 4.3> absolute-URI = <absolute-URI, see [RFC3986], Section 4.3>
absolute-form = absolute-URI absolute-form = absolute-URI
absolute-path = <absolute-path, see [Semantics], Section 4> absolute-path = <absolute-path, see [Semantics], Section 4>
asterisk-form = "*" asterisk-form = "*"
authority = <authority, see [RFC3986], Section 3.2> authority = <authority, see [RFC3986], Section 3.2>
authority-form = authority authority-form = authority
chunk = chunk-size [ chunk-ext ] CRLF chunk-data CRLF chunk = chunk-size [ chunk-ext ] CRLF chunk-data CRLF
chunk-data = 1*OCTET chunk-data = 1*OCTET
chunk-ext = *( BWS ";" BWS chunk-ext-name [ BWS "=" BWS chunk-ext-val chunk-ext = *( BWS ";" BWS chunk-ext-name [ BWS "=" BWS chunk-ext-val
] ) ] )
chunk-ext-name = token chunk-ext-name = token
chunk-ext-val = token / quoted-string chunk-ext-val = token / quoted-string
chunk-size = 1*HEXDIG chunk-size = 1*HEXDIG
chunked-body = *chunk last-chunk trailer-section CRLF chunked-body = *chunk last-chunk trailer-section CRLF
comment = <comment, see [Semantics], Section 5.7.5> comment = <comment, see [Semantics], Section 5.6.5>
field-line = field-name ":" OWS field-value OWS field-line = field-name ":" OWS field-value OWS
field-name = <field-name, see [Semantics], Section 5.4.3> field-name = <field-name, see [Semantics], Section 5.1>
field-value = <field-value, see [Semantics], Section 5.4.4> field-value = <field-value, see [Semantics], Section 5.5>
last-chunk = 1*"0" [ chunk-ext ] CRLF last-chunk = 1*"0" [ chunk-ext ] CRLF
message-body = *OCTET message-body = *OCTET
method = token method = token
obs-fold = OWS CRLF RWS obs-fold = OWS CRLF RWS
obs-text = <obs-text, see [Semantics], Section 5.7.4> obs-text = <obs-text, see [Semantics], Section 5.6.4>
origin-form = absolute-path [ "?" query ] origin-form = absolute-path [ "?" query ]
port = <port, see [RFC3986], Section 3.2.3> port = <port, see [RFC3986], Section 3.2.3>
query = <query, see [RFC3986], Section 3.4> query = <query, see [RFC3986], Section 3.4>
quoted-string = <quoted-string, see [Semantics], Section 5.7.4> quoted-string = <quoted-string, see [Semantics], Section 5.6.4>
reason-phrase = 1*( HTAB / SP / VCHAR / obs-text ) reason-phrase = 1*( HTAB / SP / VCHAR / obs-text )
request-line = method SP request-target SP HTTP-version request-line = method SP request-target SP HTTP-version
request-target = origin-form / absolute-form / authority-form / request-target = origin-form / absolute-form / authority-form /
asterisk-form asterisk-form
start-line = request-line / status-line start-line = request-line / status-line
status-code = 3DIGIT status-code = 3DIGIT
status-line = HTTP-version SP status-code SP [ reason-phrase ] status-line = HTTP-version SP status-code SP [ reason-phrase ]
token = <token, see [Semantics], Section 5.7.2> token = <token, see [Semantics], Section 5.6.2>
trailer-section = *( field-line CRLF ) trailer-section = *( field-line CRLF )
transfer-coding = token *( OWS ";" OWS transfer-parameter ) transfer-coding = <transfer-coding, see [Semantics], Section 10.1.4>
transfer-parameter = token BWS "=" BWS ( token / quoted-string )
uri-host = <host, see [RFC3986], Section 3.2.2> uri-host = <host, see [RFC3986], Section 3.2.2>
Appendix B. Differences between HTTP and MIME Appendix B. Differences between HTTP and MIME
HTTP/1.1 uses many of the constructs defined for the Internet Message HTTP/1.1 uses many of the constructs defined for the Internet Message
Format [RFC5322] and the Multipurpose Internet Mail Extensions (MIME) Format [RFC5322] and the Multipurpose Internet Mail Extensions (MIME)
[RFC2045] to allow a message body to be transmitted in an open [RFC2045] to allow a message body to be transmitted in an open
variety of representations and with extensible fields. However, RFC variety of representations and with extensible fields. However, RFC
2045 is focused only on email; applications of HTTP have many 2045 is focused only on email; applications of HTTP have many
characteristics that differ from email; hence, HTTP has features that characteristics that differ from email; hence, HTTP has features that
skipping to change at page 45, line 24 skipping to change at page 45, line 39
MIME protocol was used to construct the message. Use of the MIME- MIME protocol was used to construct the message. Use of the MIME-
Version header field indicates that the message is in full Version header field indicates that the message is in full
conformance with the MIME protocol (as defined in [RFC2045]). conformance with the MIME protocol (as defined in [RFC2045]).
Senders are responsible for ensuring full conformance (where Senders are responsible for ensuring full conformance (where
possible) when exporting HTTP messages to strict MIME environments. possible) when exporting HTTP messages to strict MIME environments.
B.2. Conversion to Canonical Form B.2. Conversion to Canonical Form
MIME requires that an Internet mail body part be converted to MIME requires that an Internet mail body part be converted to
canonical form prior to being transferred, as described in Section 4 canonical form prior to being transferred, as described in Section 4
of [RFC2049]. Section 7.4.3 of [Semantics] describes the forms of [RFC2049]. Section 8.4.3 of [Semantics] describes the forms
allowed for subtypes of the "text" media type when transmitted over allowed for subtypes of the "text" media type when transmitted over
HTTP. [RFC2046] requires that content with a type of "text" HTTP. [RFC2046] requires that content with a type of "text"
represent line breaks as CRLF and forbids the use of CR or LF outside represent line breaks as CRLF and forbids the use of CR or LF outside
of line break sequences. HTTP allows CRLF, bare CR, and bare LF to of line break sequences. HTTP allows CRLF, bare CR, and bare LF to
indicate a line break within text content. indicate a line break within text content.
A proxy or gateway from HTTP to a strict MIME environment ought to A proxy or gateway from HTTP to a strict MIME environment ought to
translate all line breaks within text media types to the RFC 2049 translate all line breaks within text media types to the RFC 2049
canonical form of CRLF. Note, however, this might be complicated by canonical form of CRLF. Note, however, this might be complicated by
the presence of a Content-Encoding and by the fact that HTTP allows the presence of a Content-Encoding and by the fact that HTTP allows
the use of some charsets that do not use octets 13 and 10 to the use of some charsets that do not use octets 13 and 10 to
represent CR and LF, respectively. represent CR and LF, respectively.
Conversion will break any cryptographic checksums applied to the Conversion will break any cryptographic checksums applied to the
original content unless the original content is already in canonical original content unless the original content is already in canonical
form. Therefore, the canonical form is recommended for any content form. Therefore, the canonical form is recommended for any content
that uses such checksums in HTTP. that uses such checksums in HTTP.
B.3. Conversion of Date Formats B.3. Conversion of Date Formats
HTTP/1.1 uses a restricted set of date formats (Section 5.7.7 of HTTP/1.1 uses a restricted set of date formats (Section 5.6.7 of
[Semantics]) to simplify the process of date comparison. Proxies and [Semantics]) to simplify the process of date comparison. Proxies and
gateways from other protocols ought to ensure that any Date header gateways from other protocols ought to ensure that any Date header
field present in a message conforms to one of the HTTP/1.1 formats field present in a message conforms to one of the HTTP/1.1 formats
and rewrite the date if necessary. and rewrite the date if necessary.
B.4. Conversion of Content-Encoding B.4. Conversion of Content-Encoding
MIME does not include any concept equivalent to HTTP/1.1's Content- MIME does not include any concept equivalent to HTTP/1.1's Content-
Encoding header field. Since this acts as a modifier on the media Encoding header field. Since this acts as a modifier on the media
type, proxies and gateways from HTTP to MIME-compliant protocols type, proxies and gateways from HTTP to MIME-compliant protocols
skipping to change at page 46, line 40 skipping to change at page 47, line 4
likelihood of safe transport over the destination protocol. likelihood of safe transport over the destination protocol.
B.6. MHTML and Line Length Limitations B.6. MHTML and Line Length Limitations
HTTP implementations that share code with MHTML [RFC2557] HTTP implementations that share code with MHTML [RFC2557]
implementations need to be aware of MIME line length limitations. implementations need to be aware of MIME line length limitations.
Since HTTP does not have this limitation, HTTP does not fold long Since HTTP does not have this limitation, HTTP does not fold long
lines. MHTML messages being transported by HTTP follow all lines. MHTML messages being transported by HTTP follow all
conventions of MHTML, including line length limitations and folding, conventions of MHTML, including line length limitations and folding,
canonicalization, etc., since HTTP transfers message-bodies as canonicalization, etc., since HTTP transfers message-bodies as
payload and, aside from the "multipart/byteranges" type (Section 13.5 payload and, aside from the "multipart/byteranges" type (Section 14.5
of [Semantics]), does not interpret the content or any MIME header of [Semantics]), does not interpret the content or any MIME header
lines that might be contained therein. lines that might be contained therein.
Appendix C. HTTP Version History Appendix C. Changes from previous RFCs
HTTP has been in use since 1990. The first version, later referred
to as HTTP/0.9, was a simple protocol for hypertext data transfer
across the Internet, using only a single request method (GET) and no
metadata. HTTP/1.0, as defined by [RFC1945], added a range of
request methods and MIME-like messaging, allowing for metadata to be
transferred and modifiers placed on the request/response semantics.
However, HTTP/1.0 did not sufficiently take into consideration the
effects of hierarchical proxies, caching, the need for persistent
connections, or name-based virtual hosts. The proliferation of
incompletely implemented applications calling themselves "HTTP/1.0"
further necessitated a protocol version change in order for two
communicating applications to determine each other's true
capabilities.
HTTP/1.1 remains compatible with HTTP/1.0 by including more stringent
requirements that enable reliable implementations, adding only those
features that can either be safely ignored by an HTTP/1.0 recipient
or only be sent when communicating with a party advertising
conformance with HTTP/1.1.
HTTP/1.1 has been designed to make supporting previous versions easy. C.1. Changes from HTTP/0.9
A general-purpose HTTP/1.1 server ought to be able to understand any
valid request in the format of HTTP/1.0, responding appropriately
with an HTTP/1.1 message that only uses features understood (or
safely ignored) by HTTP/1.0 clients. Likewise, an HTTP/1.1 client
can be expected to understand any valid HTTP/1.0 response.
Since HTTP/0.9 did not support header fields in a request, there is Since HTTP/0.9 did not support header fields in a request, there is
no mechanism for it to support name-based virtual hosts (selection of no mechanism for it to support name-based virtual hosts (selection of
resource by inspection of the Host header field). Any server that resource by inspection of the Host header field). Any server that
implements name-based virtual hosts ought to disable support for implements name-based virtual hosts ought to disable support for
HTTP/0.9. Most requests that appear to be HTTP/0.9 are, in fact, HTTP/0.9. Most requests that appear to be HTTP/0.9 are, in fact,
badly constructed HTTP/1.x requests caused by a client failing to badly constructed HTTP/1.x requests caused by a client failing to
properly encode the request-target. properly encode the request-target.
C.1. Changes from HTTP/1.0 C.2. Changes from HTTP/1.0
This section summarizes major differences between versions HTTP/1.0
and HTTP/1.1.
C.1.1. Multihomed Web Servers C.2.1. Multihomed Web Servers
The requirements that clients and servers support the Host header The requirements that clients and servers support the Host header
field (Section 6.1.2 of [Semantics]), report an error if it is field (Section 7.2 of [Semantics]), report an error if it is missing
missing from an HTTP/1.1 request, and accept absolute URIs from an HTTP/1.1 request, and accept absolute URIs (Section 3.2) are
(Section 3.2) are among the most important changes defined by among the most important changes defined by HTTP/1.1.
HTTP/1.1.
Older HTTP/1.0 clients assumed a one-to-one relationship of IP Older HTTP/1.0 clients assumed a one-to-one relationship of IP
addresses and servers; there was no other established mechanism for addresses and servers; there was no other established mechanism for
distinguishing the intended server of a request than the IP address distinguishing the intended server of a request than the IP address
to which that request was directed. The Host header field was to which that request was directed. The Host header field was
introduced during the development of HTTP/1.1 and, though it was introduced during the development of HTTP/1.1 and, though it was
quickly implemented by most HTTP/1.0 browsers, additional quickly implemented by most HTTP/1.0 browsers, additional
requirements were placed on all HTTP/1.1 requests in order to ensure requirements were placed on all HTTP/1.1 requests in order to ensure
complete adoption. At the time of this writing, most HTTP-based complete adoption. At the time of this writing, most HTTP-based
services are dependent upon the Host header field for targeting services are dependent upon the Host header field for targeting
requests. requests.
C.1.2. Keep-Alive Connections C.2.2. Keep-Alive Connections
In HTTP/1.0, each connection is established by the client prior to In HTTP/1.0, each connection is established by the client prior to
the request and closed by the server after sending the response. the request and closed by the server after sending the response.
However, some implementations implement the explicitly negotiated However, some implementations implement the explicitly negotiated
("Keep-Alive") version of persistent connections described in ("Keep-Alive") version of persistent connections described in
Section 19.7.1 of [RFC2068]. Section 19.7.1 of [RFC2068].
Some clients and servers might wish to be compatible with these Some clients and servers might wish to be compatible with these
previous approaches to persistent connections, by explicitly previous approaches to persistent connections, by explicitly
negotiating for them with a "Connection: keep-alive" request header negotiating for them with a "Connection: keep-alive" request header
skipping to change at page 48, line 40 skipping to change at page 48, line 24
As a result, clients are encouraged not to send the Proxy-Connection As a result, clients are encouraged not to send the Proxy-Connection
header field in any requests. header field in any requests.
Clients are also encouraged to consider the use of Connection: keep- Clients are also encouraged to consider the use of Connection: keep-
alive in requests carefully; while they can enable persistent alive in requests carefully; while they can enable persistent
connections with HTTP/1.0 servers, clients using them will need to connections with HTTP/1.0 servers, clients using them will need to
monitor the connection for "hung" requests (which indicate that the monitor the connection for "hung" requests (which indicate that the
client ought stop sending the header field), and this mechanism ought client ought stop sending the header field), and this mechanism ought
not be used by clients at all when a proxy is being used. not be used by clients at all when a proxy is being used.
C.1.3. Introduction of Transfer-Encoding C.2.3. Introduction of Transfer-Encoding
HTTP/1.1 introduces the Transfer-Encoding header field (Section 6.1). HTTP/1.1 introduces the Transfer-Encoding header field (Section 6.1).
Transfer codings need to be decoded prior to forwarding an HTTP Transfer codings need to be decoded prior to forwarding an HTTP
message over a MIME-compliant protocol. message over a MIME-compliant protocol.
C.2. Changes from RFC 7230 C.3. Changes from RFC 7230
Most of the sections introducing HTTP's design goals, history, Most of the sections introducing HTTP's design goals, history,
architecture, conformance criteria, protocol versioning, URIs, architecture, conformance criteria, protocol versioning, URIs,
message routing, and header fields have been moved to [Semantics]. message routing, and header fields have been moved to [Semantics].
This document has been reduced to just the messaging syntax and This document has been reduced to just the messaging syntax and
connection management requirements specific to HTTP/1.1. connection management requirements specific to HTTP/1.1.
Prohibited generation of bare CRs outside of payload body. Prohibited generation of bare CRs outside of payload data.
(Section 2.2) (Section 2.2)
In the ABNF for chunked extensions, re-introduced (bad) whitespace In the ABNF for chunked extensions, re-introduced (bad) whitespace
around ";" and "=". Whitespace was removed in [RFC7230], but that around ";" and "=". Whitespace was removed in [RFC7230], but that
change was found to break existing implementations (see [Err4667]). change was found to break existing implementations (see [Err4667]).
(Section 7.1.1) (Section 7.1.1)
Trailer field semantics now transcend the specifics of chunked Trailer field semantics now transcend the specifics of chunked
encoding. The decoding algorithm for chunked (Section 7.1.3) has encoding. The decoding algorithm for chunked (Section 7.1.3) has
been updated to encourage storage/forwarding of trailer fields been updated to encourage storage/forwarding of trailer fields
skipping to change at page 51, line 40 skipping to change at page 51, line 14
o In Section 7, remove the predefined codings from the ABNF and make o In Section 7, remove the predefined codings from the ABNF and make
it generic instead (<https://github.com/httpwg/http-core/ it generic instead (<https://github.com/httpwg/http-core/
issues/66>) issues/66>)
o Use RFC 7405 ABNF notation for case-sensitive string constants o Use RFC 7405 ABNF notation for case-sensitive string constants
(<https://github.com/httpwg/http-core/issues/133>) (<https://github.com/httpwg/http-core/issues/133>)
D.6. Since draft-ietf-httpbis-messaging-04 D.6. Since draft-ietf-httpbis-messaging-04
o In Section 6.6 of [Semantics], clarify that protocol-name is to be o In Section 7.8 of [Semantics], clarify that protocol-name is to be
matched case-insensitively (<https://github.com/httpwg/http-core/ matched case-insensitively (<https://github.com/httpwg/http-core/
issues/8>) issues/8>)
o In Section 5.2, add leading optional whitespace to obs-fold ABNF o In Section 5.2, add leading optional whitespace to obs-fold ABNF
(<https://github.com/httpwg/http-core/issues/19>, (<https://github.com/httpwg/http-core/issues/19>,
<https://www.rfc-editor.org/errata/eid4189>) <https://www.rfc-editor.org/errata/eid4189>)
o In Section 4, add clarifications about empty reason phrases o In Section 4, add clarifications about empty reason phrases
(<https://github.com/httpwg/http-core/issues/197>) (<https://github.com/httpwg/http-core/issues/197>)
skipping to change at page 52, line 21 skipping to change at page 51, line 44
fields only if understood and defined as being mergeable fields only if understood and defined as being mergeable
(<https://github.com/httpwg/http-core/issues/16>) (<https://github.com/httpwg/http-core/issues/16>)
o In Section 2.1 and related Sections, move the trailing CRLF from o In Section 2.1 and related Sections, move the trailing CRLF from
the line grammars into the message format the line grammars into the message format
(<https://github.com/httpwg/http-core/issues/62>) (<https://github.com/httpwg/http-core/issues/62>)
o Moved Section 2.3 down (<https://github.com/httpwg/http-core/ o Moved Section 2.3 down (<https://github.com/httpwg/http-core/
issues/68>) issues/68>)
o In Section 6.6 of [Semantics], use 'websocket' instead of o In Section 7.8 of [Semantics], use 'websocket' instead of
'HTTP/2.0' in examples (<https://github.com/httpwg/http-core/ 'HTTP/2.0' in examples (<https://github.com/httpwg/http-core/
issues/112>) issues/112>)
o Move version non-specific text from Section 6 into semantics as o Move version non-specific text from Section 6 into semantics as
"payload body" (<https://github.com/httpwg/http-core/issues/159>) "payload" (<https://github.com/httpwg/http-core/issues/159>)
o In Section 9.8, add text from RFC 2818 o In Section 9.8, add text from RFC 2818
(<https://github.com/httpwg/http-core/issues/236>) (<https://github.com/httpwg/http-core/issues/236>)
D.8. Since draft-ietf-httpbis-messaging-06 D.8. Since draft-ietf-httpbis-messaging-06
o In Section 12.4, update the APLN protocol id for HTTP/1.1 o In Section 12.4, update the APLN protocol id for HTTP/1.1
(<https://github.com/httpwg/http-core/issues/49>) (<https://github.com/httpwg/http-core/issues/49>)
o In Section 5, align with updates to field terminology in semantics o In Section 5, align with updates to field terminology in semantics
(<https://github.com/httpwg/http-core/issues/111>) (<https://github.com/httpwg/http-core/issues/111>)
o In Section 6.4.1 of [Semantics], clarify that new connection o In Section 7.6.1 of [Semantics], clarify that new connection
options indeed need to be registered (<https://github.com/httpwg/ options indeed need to be registered (<https://github.com/httpwg/
http-core/issues/285>) http-core/issues/285>)
o In Section 1.1, reference RFC 8174 as well o In Section 1.1, reference RFC 8174 as well
(<https://github.com/httpwg/http-core/issues/303>) (<https://github.com/httpwg/http-core/issues/303>)
D.9. Since draft-ietf-httpbis-messaging-07 D.9. Since draft-ietf-httpbis-messaging-07
o Move TE: trailers into [Semantics] (<https://github.com/httpwg/ o Move TE: trailers into [Semantics] (<https://github.com/httpwg/
http-core/issues/18>) http-core/issues/18>)
skipping to change at page 54, line 5 skipping to change at page 53, line 28
(<https://github.com/httpwg/http-core/issues/392>) (<https://github.com/httpwg/http-core/issues/392>)
o Moved definition of "Connection" into [Semantics] o Moved definition of "Connection" into [Semantics]
(<https://github.com/httpwg/http-core/issues/407>) (<https://github.com/httpwg/http-core/issues/407>)
D.13. Since draft-ietf-httpbis-messaging-11 D.13. Since draft-ietf-httpbis-messaging-11
o Move IANA Upgrade Token Registry instructions to [Semantics] o Move IANA Upgrade Token Registry instructions to [Semantics]
(<https://github.com/httpwg/http-core/issues/450>) (<https://github.com/httpwg/http-core/issues/450>)
D.14. Since draft-ietf-httpbis-messaging-12
o Moved content of history appendix to Semantics
(<https://github.com/httpwg/http-core/issues/451>)
o Moved note about "close" being reserved as field name to
Section 9.3 (<https://github.com/httpwg/http-core/issues/500>)
o Moved table of transfer codings into Section 12.3
(<https://github.com/httpwg/http-core/issues/506>)
o In Section 13.2, updated the URI for the [Linhart] paper
(<https://github.com/httpwg/http-core/issues/517>)
o Changed document title to just "HTTP/1.1"
(<https://github.com/httpwg/http-core/issues/524>)
o In Section 7, moved transfer-coding ABNF to Section 10.1.4 of
[Semantics] (<https://github.com/httpwg/http-core/issues/531>)
o Changed to using "payload data" when defining requirements about
the data being conveyed within a message, instead of the terms
"payload body" or "response body" or "representation body", since
they often get confused with the HTTP/1.1 message body (which
includes transfer coding) (<https://github.com/httpwg/http-core/
issues/553>)
Acknowledgments Acknowledgments
See Appendix "Acknowledgments" of [Semantics]. See Appendix "Acknowledgments" of [Semantics].
Authors' Addresses Authors' Addresses
Roy T. Fielding (editor) Roy T. Fielding (editor)
Adobe Adobe
345 Park Ave 345 Park Ave
San Jose, CA 95110 San Jose, CA 95110
 End of changes. 124 change blocks. 
289 lines changed or deleted 278 lines changed or added

This html diff was produced by rfcdiff 1.45. The latest version is available from http://tools.ietf.org/tools/rfcdiff/