draft-reschke-http-jfv-11.txt		draft-reschke-http-jfv-12.txt
	Network Working Group J. F. Reschke		Network Working Group J. F. Reschke
	Internet-Draft greenbytes		Internet-Draft greenbytes
	Intended status: Informational 20 November 2019		Intended status: Informational September 1, 2020
	Expires: 23 May 2020		Expires: March 5, 2021
	A JSON Encoding for HTTP Header Field Values		A JSON Encoding for HTTP Field Values
	draft-reschke-http-jfv-11		draft-reschke-http-jfv-12
	Abstract		Abstract
	This document establishes a convention for use of JSON-encoded field		This document establishes a convention for use of JSON-encoded field
	values in HTTP header fields.		values in HTTP fields.
	Editorial Note		Editorial Note
	This note is to be removed before publishing as an RFC.		This note is to be removed before publishing as an RFC.
	Distribution of this document is unlimited. Although this is not a		Distribution of this document is unlimited. Although this is not a
	work item of the HTTPbis Working Group, comments should be sent to		work item of the HTTPbis Working Group, comments should be sent to
	the Hypertext Transfer Protocol (HTTP) mailing list at ietf-http-		the Hypertext Transfer Protocol (HTTP) mailing list at ietf-http-
	wg@w3.org (mailto:ietf-http-wg@w3.org), which may be joined by		wg@w3.org (mailto:ietf-http-wg@w3.org), which may be joined by
	sending a message with subject "subscribe" to ietf-http-wg-		sending a message with subject "subscribe" to ietf-http-wg-
	request@w3.org (mailto:ietf-http-wg-		request@w3.org (mailto:ietf-http-wg-
	request@w3.org?subject=subscribe).		request@w3.org?subject=subscribe).
	Discussions of the HTTPbis Working Group are archived at		Discussions of the HTTPbis Working Group are archived at
	http://lists.w3.org/Archives/Public/ietf-http-wg/.		<http://lists.w3.org/Archives/Public/ietf-http-wg/>.
	XML versions and latest edits for this document are available from		XML versions and latest edits for this document are available from
	http://greenbytes.de/tech/webdav/#draft-reschke-http-jfv.		<http://greenbytes.de/tech/webdav/#draft-reschke-http-jfv>.
	The changes in this draft are summarized in Appendix E.14.		The changes in this draft are summarized in Appendix B.15.
	Status of This Memo		Status of This Memo
	This Internet-Draft is submitted in full conformance with the		This Internet-Draft is submitted in full conformance with the
	provisions of BCP 78 and BCP 79.		provisions of BCP 78 and BCP 79.
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF). Note that other groups may also distribute		Task Force (IETF). Note that other groups may also distribute
	working documents as Internet-Drafts. The list of current Internet-		working documents as Internet-Drafts. The list of current Internet-
	Drafts is at https://datatracker.ietf.org/drafts/current/.		Drafts is at https://datatracker.ietf.org/drafts/current/.
	Internet-Drafts are draft documents valid for a maximum of six months		Internet-Drafts are draft documents valid for a maximum of six months
	and may be updated, replaced, or obsoleted by other documents at any		and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference		time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."		material or to cite them other than as "work in progress."
	This Internet-Draft will expire on 23 May 2020.		This Internet-Draft will expire on March 5, 2021.
	Copyright Notice		Copyright Notice
	Copyright (c) 2019 IETF Trust and the persons identified as the		Copyright (c) 2020 IETF Trust and the persons identified as the
	document authors. All rights reserved.		document authors. All rights reserved.
	This document is subject to BCP 78 and the IETF Trust's Legal		This document is subject to BCP 78 and the IETF Trust's Legal
	Provisions Relating to IETF Documents (https://trustee.ietf.org/		Provisions Relating to IETF Documents (https://trustee.ietf.org/
	license-info) in effect on the date of publication of this document.		license-info) in effect on the date of publication of this document.
	Please review these documents carefully, as they describe your rights		Please review these documents carefully, as they describe your rights
	and restrictions with respect to this document. Code Components		and restrictions with respect to this document. Code Components
	extracted from this document must include Simplified BSD License text		extracted from this document must include Simplified BSD License text
	as described in Section 4.e of the Trust Legal Provisions and are		as described in Section 4.e of the Trust Legal Provisions and are
	provided without warranty as described in the Simplified BSD License.		provided without warranty as described in the Simplified BSD License.
	Table of Contents		Table of Contents
	1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3		1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
	2. Data Model and Format . . . . . . . . . . . . . . . . . . . . 4		2. Data Model and Format . . . . . . . . . . . . . . . . . . . . 4
	3. Sender Requirements . . . . . . . . . . . . . . . . . . . . . 5		3. Sender Requirements . . . . . . . . . . . . . . . . . . . . . 5
	4. Recipient Requirements . . . . . . . . . . . . . . . . . . . 5		4. Recipient Requirements . . . . . . . . . . . . . . . . . . . 5
	5. Using this Format in Header Field Definitions . . . . . . . . 6		5. Using this Format in Field Definitions . . . . . . . . . . . 5
	6. Deployment Considerations . . . . . . . . . . . . . . . . . . 6		6. Deployment Considerations . . . . . . . . . . . . . . . . . . 6
	7. Interoperability Considerations . . . . . . . . . . . . . . . 6		7. Interoperability Considerations . . . . . . . . . . . . . . . 6
	7.1. Encoding and Characters . . . . . . . . . . . . . . . . . 6		7.1. Encoding and Characters . . . . . . . . . . . . . . . . . 6
	7.2. Numbers . . . . . . . . . . . . . . . . . . . . . . . . . 7		7.2. Numbers . . . . . . . . . . . . . . . . . . . . . . . . . 6
	7.3. Object Constraints . . . . . . . . . . . . . . . . . . . 7		7.3. Object Constraints . . . . . . . . . . . . . . . . . . . 7
	8. Internationalization Considerations . . . . . . . . . . . . . 7		8. Internationalization Considerations . . . . . . . . . . . . . 7
	9. Security Considerations . . . . . . . . . . . . . . . . . . . 7		9. Security Considerations . . . . . . . . . . . . . . . . . . . 7
	10. References . . . . . . . . . . . . . . . . . . . . . . . . . 7		10. References . . . . . . . . . . . . . . . . . . . . . . . . . 7
	10.1. Normative References . . . . . . . . . . . . . . . . . . 7		10.1. Normative References . . . . . . . . . . . . . . . . . . 7
	10.2. Informative References . . . . . . . . . . . . . . . . . 8		10.2. Informative References . . . . . . . . . . . . . . . . . 8
	Appendix A. Examples . . . . . . . . . . . . . . . . . . . . . . 10		10.3. Specifications Using This Syntax (at some point of
	A.1. Content-Length . . . . . . . . . . . . . . . . . . . . . 10		time) . . . . . . . . . . . . . . . . . . . . . . . . . 9
	A.2. Content-Disposition . . . . . . . . . . . . . . . . . . . 10		Appendix A. Use of JSON Field Value Encoding in the Wild . . . . 9
	A.3. WWW-Authenticate . . . . . . . . . . . . . . . . . . . . 11		A.1. W3C Reporting API Specification . . . . . . . . . . . . . 9
	A.4. Accept-Encoding . . . . . . . . . . . . . . . . . . . . . 12		A.2. W3C Clear Site Data Specification . . . . . . . . . . . . 9
	Appendix B. Use of JSON Field Value Encoding in the Wild . . . . 13		A.3. W3C Feature Policy Specification . . . . . . . . . . . . 10
	B.1. W3C Reporting API Specification . . . . . . . . . . . . . 14		Appendix B. Change Log . . . . . . . . . . . . . . . . . . . . . 10
	B.2. W3C Clear Site Data Specification . . . . . . . . . . . . 14		B.1. Since draft-reschke-http-jfv-00 . . . . . . . . . . . . . 10
	B.3. W3C Feature Policy Specification . . . . . . . . . . . . 14		B.2. Since draft-reschke-http-jfv-01 . . . . . . . . . . . . . 10
	Appendix C. Relation to HTTP 'Key' Header Field . . . . . . . . 14		B.3. Since draft-reschke-http-jfv-02 . . . . . . . . . . . . . 10
	Appendix D. Discussion . . . . . . . . . . . . . . . . . . . . . 14		B.4. Since draft-reschke-http-jfv-03 . . . . . . . . . . . . . 10
	Appendix E. Change Log . . . . . . . . . . . . . . . . . . . . . 14		B.5. Since draft-reschke-http-jfv-04 . . . . . . . . . . . . . 10
	E.1. Since draft-reschke-http-jfv-00 . . . . . . . . . . . . . 15		B.6. Since draft-ietf-httpbis-jfv-00 . . . . . . . . . . . . . 10
	E.2. Since draft-reschke-http-jfv-01 . . . . . . . . . . . . . 15		B.7. Since draft-ietf-httpbis-jfv-01 . . . . . . . . . . . . . 11
	E.3. Since draft-reschke-http-jfv-02 . . . . . . . . . . . . . 15		B.8. Since draft-ietf-httpbis-jfv-02 . . . . . . . . . . . . . 11
	E.4. Since draft-reschke-http-jfv-03 . . . . . . . . . . . . . 15		B.9. Since draft-reschke-http-jfv-05 . . . . . . . . . . . . . 11
	E.5. Since draft-reschke-http-jfv-04 . . . . . . . . . . . . . 15		B.10. Since draft-reschke-http-jfv-06 . . . . . . . . . . . . . 11
	E.6. Since draft-ietf-httpbis-jfv-00 . . . . . . . . . . . . . 15		B.11. Since draft-reschke-http-jfv-07 . . . . . . . . . . . . . 11
	E.7. Since draft-ietf-httpbis-jfv-01 . . . . . . . . . . . . . 15		B.12. Since draft-reschke-http-jfv-08 . . . . . . . . . . . . . 11
	E.8. Since draft-ietf-httpbis-jfv-02 . . . . . . . . . . . . . 15		B.13. Since draft-reschke-http-jfv-09 . . . . . . . . . . . . . 11
	E.9. Since draft-reschke-http-jfv-05 . . . . . . . . . . . . . 16		B.14. Since draft-reschke-http-jfv-10 . . . . . . . . . . . . . 12
	E.10. Since draft-reschke-http-jfv-06 . . . . . . . . . . . . . 16		B.15. Since draft-reschke-http-jfv-11 . . . . . . . . . . . . . 12
	E.11. Since draft-reschke-http-jfv-07 . . . . . . . . . . . . . 16		Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 12
	E.12. Since draft-reschke-http-jfv-08 . . . . . . . . . . . . . 16		Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 12
	E.13. Since draft-reschke-http-jfv-09 . . . . . . . . . . . . . 16
	E.14. Since draft-reschke-http-jfv-10 . . . . . . . . . . . . . 16
	Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 16
	Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 16
	1. Introduction		1. Introduction
	Defining syntax for new HTTP header fields ([RFC7230], Section 3.2)		Defining syntax for new HTTP fields ([HTTP], Section 5) is non-
	is non-trivial. Among the commonly encountered problems are:		trivial. Among the commonly encountered problems are:
	* There is no common syntax for complex field values. Several well-		o There is no common syntax for complex field values. Several well-
	known header fields do use a similarly looking syntax, but it is		known fields do use a similarly looking syntax, but it is hard to
	hard to write generic parsing code that will both correctly handle		write generic parsing code that will both correctly handle valid
	valid field values but also reject invalid ones.		field values but also reject invalid ones.
	* The HTTP message format allows header fields to repeat, so field		o The HTTP message format allows fields to repeat, so field syntax
	syntax needs to be designed in a way that these cases are either		needs to be designed in a way that these cases are either
	meaningful, or can be unambiguously detected and rejected.		meaningful, or can be unambiguously detected and rejected.
	* HTTP/1.1 does not define a character encoding scheme ([RFC6365],		o HTTP does not define a character encoding scheme ([RFC6365],
	Section 2), so header fields are either stuck with US-ASCII		Section 2), so fields are either stuck with US-ASCII ([RFC0020]),
	([RFC0020]), or need out-of-band information to decide what		or need out-of-band information to decide what encoding scheme is
	encoding scheme is used. Furthermore, APIs usually assume a		used. Furthermore, APIs usually assume a default encoding scheme
	default encoding scheme in order to map from octet sequences to		in order to map from octet sequences to strings (for instance,
	strings (for instance, [XMLHttpRequest] uses the IDL type		[XMLHttpRequest] uses the IDL type "ByteString", effectively
	"ByteString", effectively resulting in the ISO-8859-1 character		resulting in the ISO-8859-1 character encoding scheme [ISO-8859-1]
	encoding scheme [ISO-8859-1] being used).		being used).
	(See Section 8.3.1 of [RFC7231] for a summary of considerations for		(See Section 5.7 of [HTTP] for a summary of considerations for new
	new header fields.)		fields.)
	This specification addresses the issues listed above by defining both		This specification addresses the issues listed above by defining both
	a generic JSON-based ([RFC8259]) data model and a concrete wire		a generic JSON-based ([RFC8259]) data model and a concrete wire
	format that can be used in definitions of new header fields, where		format that can be used in definitions of new fields, where the goals
	the goals were:		were:
	* to be compatible with header field recombination when fields occur		o to be compatible with field recombination when fields occur
	multiple times in a single message (Section 3.2.2 of [RFC7230]),		multiple times in a single message (Section 5.1 of [HTTP]), and
	and
	* not to use any problematic characters in the field value (non-		o not to use any problematic characters in the field value (non-
	ASCII characters and certain whitespace characters).		ASCII characters and certain whitespace characters).
	| *Note:*[HSTRUCT], a work item of the IETF HTTP Working Group,		| *Note:* [HSTRUCT], a work item of the IETF HTTP Working Group,
	| is a different attempt to address this set of problems -- it		| is a different attempt to address this set of problems - it
	| tries to identify and formalize common field structures in		| tries to identify and formalize common field structures in
	| existing header fields; the syntax defined over there would		| existing fields; the syntax defined over there would usually
	| usually lead to a more compact notation.		| lead to a more compact notation.
	2. Data Model and Format		2. Data Model and Format
	In HTTP, header fields with the same field name can occur multiple		In HTTP, fields with the same field name can occur multiple times
	times within a single message (Section 3.2.2 of [RFC7230]). When		within a single message (Section 5.1 of [HTTP]). When this happens,
	this happens, recipients are allowed to combine the field values		recipients are allowed to combine the field values using commas as
	using commas as delimiter. This rule matches nicely JSON's array		delimiter. This rule matches nicely JSON's array format (Section 5
	format (Section 5 of [RFC8259]). Thus, the basic data model used		of [RFC8259]). Thus, the basic data model used here is the JSON
	here is the JSON array.		array.
	Header field definitions that need only a single value can restrict		Field definitions that need only a single value can restrict
	themselves to arrays of length 1, and are encouraged to define error		themselves to arrays of length 1, and are encouraged to define error
	handling in case more values are received (such as "first wins",		handling in case more values are received (such as "first wins",
	"last wins", or "abort with fatal error message").		"last wins", or "abort with fatal error message").
	JSON arrays are mapped to field values by creating a sequence of		JSON arrays are mapped to field values by creating a sequence of
	serialized member elements, separated by commas and optionally		serialized member elements, separated by commas and optionally
	whitespace. This is equivalent to using the full JSON array format,		whitespace. This is equivalent to using the full JSON array format,
	while leaving out the "begin-array" ('[') and "end-array" (']')		while leaving out the "begin-array" ('[') and "end-array" (']')
	delimiters.		delimiters.
	The ABNF character names and classes below are used (copied from		The ABNF character names and classes below are used (copied from
	[RFC5234], Appendix B.1):		[RFC5234], Appendix B.1):
	CR = %x0D ; carriage return		CR = %x0D ; carriage return
	HTAB = %x09 ; horizontal tab		HTAB = %x09 ; horizontal tab
	LF = %x0A ; line feed		LF = %x0A ; line feed
	SP = %x20 ; space		SP = %x20 ; space
	VCHAR = %x21-7E ; visible (printing) characters		VCHAR = %x21-7E ; visible (printing) characters
	Characters in JSON strings that are not allowed or discouraged in		Characters in JSON strings that are not allowed or discouraged in
	HTTP header field values -- that is, not in the "VCHAR" definition --		HTTP field values - that is, not in the "VCHAR" definition - need to
	need to be represented using JSON's "backslash" escaping mechanism		be represented using JSON's "backslash" escaping mechanism
	([RFC8259], Section 7).		([RFC8259], Section 7).
	The control characters CR, LF, and HTAB do not appear inside JSON		The control characters CR, LF, and HTAB do not appear inside JSON
	strings, but can be used outside (line breaks, indentation etc.).		strings, but can be used outside (line breaks, indentation etc.).
	These characters need to be either stripped or replaced by space		These characters need to be either stripped or replaced by space
	characters (ABNF "SP").		characters (ABNF "SP").
	Formally, using the HTTP specification's ABNF extensions defined in		Formally, using the HTTP specification's ABNF extensions defined in
	Section 7 of [RFC7230]:		Section 5.5 of [HTTP]:
	json-field-value = #json-field-item		json-field-value = #json-field-item
	json-field-item = JSON-Text		json-field-item = JSON-Text
	; see [RFC8259], Section 2,		; see [RFC8259], Section 2,
	; post-processed so that only VCHAR characters		; post-processed so that only VCHAR characters
	; are used		; are used
	3. Sender Requirements		3. Sender Requirements
	To map a JSON array to an HTTP header field value, process each array		To map a JSON array to an HTTP field value, process each array
	element separately by:		element separately by:
	1. generating the JSON representation,		1. generating the JSON representation,
	2. stripping all JSON control characters (CR, HTAB, LF), or		2. stripping all JSON control characters (CR, HTAB, LF), or
	replacing them by space ("SP") characters,		replacing them by space ("SP") characters,
	3. replacing all remaining non-VSPACE characters by the equivalent		3. replacing all remaining non-VSPACE characters by the equivalent
	backslash-escape sequence ([RFC8259], Section 7).		backslash-escape sequence ([RFC8259], Section 7).
	The resulting list of strings is transformed into an HTTP field value		The resulting list of strings is transformed into an HTTP field value
	by combining them using comma (%x2C) plus optional SP as delimiter,		by combining them using comma (%x2C) plus optional SP as delimiter,
	and encoding the resulting string into an octet sequence using the		and encoding the resulting string into an octet sequence using the
	US-ASCII character encoding scheme ([RFC0020]).		US-ASCII character encoding scheme ([RFC0020]).
	4. Recipient Requirements		4. Recipient Requirements
	To map a set of HTTP header field instances to a JSON array:		To map a set of HTTP field instances to a JSON array:
	1. combine all header field instances into a single field as per		1. combine all field instances into a single field as per
	Section 3.2.2 of [RFC7230],		Section 5.1 of [HTTP],
	2. add a leading begin-array ("[") octet and a trailing end-array		2. add a leading begin-array ("[") octet and a trailing end-array
	("]") octet, then		("]") octet, then
	3. run the resulting octet sequence through a JSON parser.		3. run the resulting octet sequence through a JSON parser.
	The result of the parsing operation is either an error (in which case		The result of the parsing operation is either an error (in which case
	the header field values needs to be considered invalid), or a JSON		the field values needs to be considered invalid), or a JSON array.
	array.
	5. Using this Format in Header Field Definitions		5. Using this Format in Field Definitions
	Specifications defining new HTTP header fields need to take the		Specifications defining new HTTP fields need to take the
	considerations listed in Section 8.3.1 of [RFC7231] into account.		considerations listed in Section 5.7 of [HTTP] into account. Many of
	Many of these will already be accounted for by using the format		these will already be accounted for by using the format defined in
	defined in this specification.		this specification.
	Readers of HTTP-related specifications frequently expect an ABNF		Readers of HTTP-related specifications frequently expect an ABNF
	definition of the field value syntax. This is not really needed		definition of the field value syntax. This is not really needed
	here, as the actual syntax is JSON text, as defined in Section 2 of		here, as the actual syntax is JSON text, as defined in Section 2 of
	[RFC8259].		[RFC8259].
	A very simple way to use this JSON encoding thus is just to cite this		A very simple way to use this JSON encoding thus is just to cite this
	specification -- specifically the "json-field-value" ABNF production		specification - specifically the "json-field-value" ABNF production
	defined in Section 2 -- and otherwise not to talk about the details		defined in Section 2 - and otherwise not to talk about the details of
	of the field syntax at all.		the field syntax at all.
	An alternative approach is just to repeat the ABNF-related parts from		An alternative approach is just to repeat the ABNF-related parts from
	Section 2.		Section 2.
	This frees the specification from defining the concrete on-the-wire		This frees the specification from defining the concrete on-the-wire
	syntax. What's left is defining the field value in terms of a JSON		syntax. What's left is defining the field value in terms of a JSON
	array. An important aspect is the question of extensibility, e.g.		array. An important aspect is the question of extensibility, e.g.
	how recipients ought to treat unknown field names. In general, a		how recipients ought to treat unknown field names. In general, a
	"must ignore" approach will allow protocols to evolve without		"must ignore" approach will allow protocols to evolve without
	versioning or even using entire new field names.		versioning or even using entire new field names.
	6. Deployment Considerations		6. Deployment Considerations
	This JSON-based syntax will only apply to newly introduced header		This JSON-based syntax will only apply to newly introduced fields,
	fields, thus backwards compatibility is not a problem. That being		thus backwards compatibility is not a problem. That being said, it
	said, it is conceivable that there is existing code that might trip		is conceivable that there is existing code that might trip over
	over double quotes not being used for HTTP's quoted-string syntax		double quotes not being used for HTTP's quoted-string syntax
	(Section 3.2.6 of [RFC7230]).		(Section 5.4.1 of [HTTP]).
	7. Interoperability Considerations		7. Interoperability Considerations
	The "I-JSON Message Format" specification ([RFC7493]) addresses known		The "I-JSON Message Format" specification ([RFC7493]) addresses known
	JSON interoperability pain points. This specification borrows from		JSON interoperability pain points. This specification borrows from
	the requirements made over there:		the requirements made over there:
	7.1. Encoding and Characters		7.1. Encoding and Characters
	This specification requires that field values use only US-ASCII		This specification requires that field values use only US-ASCII
	skipping to change at page 7, line 24 ¶		skipping to change at page 7, line 19 ¶
	MUST NOT use duplicate object names, and recipients SHOULD either		MUST NOT use duplicate object names, and recipients SHOULD either
	treat field values with duplicate names as invalid (consistent with		treat field values with duplicate names as invalid (consistent with
	[RFC7493], Section 2.3) or use the lexically last value (consistent		[RFC7493], Section 2.3) or use the lexically last value (consistent
	with [ECMA-262], Section 24.3.1.1).		with [ECMA-262], Section 24.3.1.1).
	Furthermore, ordering of object members is not significant and can		Furthermore, ordering of object members is not significant and can
	not be relied upon.		not be relied upon.
	8. Internationalization Considerations		8. Internationalization Considerations
	In HTTP/1.1, header field values are represented by octet sequences,		In current versions of HTTP, field values are represented by octet
	usually used to transmit ASCII characters, with restrictions on the		sequences, usually used to transmit ASCII characters, with
	use of certain control characters, and no associated default		restrictions on the use of certain control characters, and no
	character encoding, nor a way to describe it ([RFC7230],		associated default character encoding, nor a way to describe it
	Section 3.2). HTTP/2 does not change this.		([HTTP], Section 5). HTTP/2 does not change this.
	This specification maps all characters which can cause problems to		This specification maps all characters which can cause problems to
	JSON escape sequences, thereby solving the HTTP header field		JSON escape sequences, thereby solving the HTTP field
	internationalization problem.		internationalization problem.
	Future specifications of HTTP might change to allow non-ASCII		Future specifications of HTTP might change to allow non-ASCII
	characters natively. In that case, header fields using the syntax		characters natively. In that case, fields using the syntax defined
	defined by this specification would have a simple migration path (by		by this specification would have a simple migration path (by just
	just stopping to require escaping of non-ASCII characters).		stopping to require escaping of non-ASCII characters).
	9. Security Considerations		9. Security Considerations
	Using JSON-shaped field values is believed to not introduce any new		Using JSON-shaped field values is believed to not introduce any new
	threads beyond those described in Section 12 of [RFC8259], namely the		threads beyond those described in Section 12 of [RFC8259], namely the
	risk of recipients using the wrong tools to parse them.		risk of recipients using the wrong tools to parse them.
	Other than that, any syntax that makes extensions easy can be used to		Other than that, any syntax that makes extensions easy can be used to
	smuggle information through field values; however, this concern is		smuggle information through field values; however, this concern is
	shared with other widely used formats, such as those using parameters		shared with other widely used formats, such as those using parameters
	in the form of name/value pairs.		in the form of name/value pairs.
	10. References		10. References
	10.1. Normative References		10.1. Normative References
			[HTTP] Fielding, R., Ed., Nottingham, M., Ed., and J. F. Reschke,
			Ed., "HTTP Semantics", Work in Progress, Internet-Draft,
			draft-ietf-httpbis-semantics-11, August 27, 2020,
			<https://tools.ietf.org/html/draft-ietf-httpbis-semantics-
			11>.
	[RFC0020] Cerf, V., "ASCII format for network interchange", STD 80,		[RFC0020] Cerf, V., "ASCII format for network interchange", STD 80,
	RFC 20, DOI 10.17487/RFC0020, October 1969,		RFC 20, DOI 10.17487/RFC0020, October 1969,
	<https://www.rfc-editor.org/info/rfc20>.		<https://www.rfc-editor.org/info/rfc20>.
	[RFC5234] Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax		[RFC5234] Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax
	Specifications: ABNF", STD 68, RFC 5234,		Specifications: ABNF", STD 68, RFC 5234,
	DOI 10.17487/RFC5234, January 2008,		DOI 10.17487/RFC5234, January 2008,
	<https://www.rfc-editor.org/info/rfc5234>.		<https://www.rfc-editor.org/info/rfc5234>.
	[RFC7230] Fielding, R., Ed. and J. F. Reschke, Ed., "Hypertext
	Transfer Protocol (HTTP/1.1): Message Syntax and Routing",
	RFC 7230, DOI 10.17487/RFC7230, June 2014,
	<https://www.rfc-editor.org/info/rfc7230>.
	[RFC7231] Fielding, R., Ed. and J. F. Reschke, Ed., "Hypertext
	Transfer Protocol (HTTP/1.1): Semantics and Content",
	RFC 7231, DOI 10.17487/RFC7231, June 2014,
	<https://www.rfc-editor.org/info/rfc7231>.
	[RFC7493] Bray, T., Ed., "The I-JSON Message Format", RFC 7493,		[RFC7493] Bray, T., Ed., "The I-JSON Message Format", RFC 7493,
	DOI 10.17487/RFC7493, March 2015,		DOI 10.17487/RFC7493, March 2015,
	<https://www.rfc-editor.org/info/rfc7493>.		<https://www.rfc-editor.org/info/rfc7493>.
	[RFC8259] Bray, T., Ed., "The JavaScript Object Notation (JSON) Data		[RFC8259] Bray, T., Ed., "The JavaScript Object Notation (JSON) Data
	Interchange Format", RFC 8259, DOI 10.17487/RFC8259,		Interchange Format", RFC 8259, DOI 10.17487/RFC8259,
	December 2017, <https://www.rfc-editor.org/info/rfc8259>.		December 2017, <https://www.rfc-editor.org/info/rfc8259>.
	10.2. Informative References		10.2. Informative References
	[CLEARSITE]
	West, M., "Clear Site Data", W3C Working Draft WD-clear-
	site-data-20171130, 30 November 2017,
	<https://www.w3.org/TR/2017/WD-clear-site-data-20171130/>.
	Latest version available at https://www.w3.org/TR/clear-
	site-data/.
	[ECMA-262] Ecma International, "ECMA-262 6th Edition, The ECMAScript		[ECMA-262] Ecma International, "ECMA-262 6th Edition, The ECMAScript
	2015 Language Specification", Standard ECMA-262, June		2015 Language Specification", Standard ECMA-262, June
	2015, <http://www.ecma-international.org/ecma-262/6.0/>.		2015, <http://www.ecma-international.org/ecma-262/6.0/>.
	[FEATUREPOL]		[HSTRUCT] Nottingham, M. and P-H. Kamp, "Structured Field Values for
	Clelland, I., "Feature Policy", W3C Draft Community Group
	Report , 3 October 2019,
	<https://wicg.github.io/feature-policy/>.
	[HSTRUCT] Nottingham, M. and P-H. Kamp, "Structured Headers for
	HTTP", Work in Progress, Internet-Draft, draft-ietf-		HTTP", Work in Progress, Internet-Draft, draft-ietf-
	httpbis-header-structure-14, October 2019,		httpbis-header-structure-19, June 2020,
	<https://tools.ietf.org/html/draft-ietf-httpbis-header-		<https://tools.ietf.org/html/draft-ietf-httpbis-header-
	structure-14>.		structure-19>.
	[ISO-8859-1]		[ISO-8859-1]
	International Organization for Standardization,		International Organization for Standardization,
	"Information technology -- 8-bit single-byte coded graphic		"Information technology -- 8-bit single-byte coded graphic
	character sets -- Part 1: Latin alphabet No. 1", ISO/		character sets -- Part 1: Latin alphabet No. 1", ISO/
	IEC 8859-1:1998, 1998.		IEC 8859-1:1998, 1998.
	[KEY] Fielding, R. and M. Nottingham, "The Key HTTP Response
	Header Field", Work in Progress, Internet-Draft, draft-
	ietf-httpbis-key-01, March 2016,
	<https://tools.ietf.org/html/draft-ietf-httpbis-key-01>.
	[REPORTING]
	Creager, D., Grigorik, I., Meyer, P., and M. West,
	"Reporting API", W3C Working Draft WD-reporting-
	1-20180925, 25 September 2018,
	<https://www.w3.org/TR/2018/WD-reporting-1-20180925/>.
	Latest version available at https://www.w3.org/TR/
	reporting-1/.
	[RFC6266] Reschke, J. F., "Use of the Content-Disposition Header
	Field in the Hypertext Transfer Protocol (HTTP)",
	RFC 6266, DOI 10.17487/RFC6266, June 2011,
	<https://www.rfc-editor.org/info/rfc6266>.
	[RFC6365] Hoffman, P. and J. Klensin, "Terminology Used in		[RFC6365] Hoffman, P. and J. Klensin, "Terminology Used in
	Internationalization in the IETF", BCP 166, RFC 6365,		Internationalization in the IETF", BCP 166, RFC 6365,
	DOI 10.17487/RFC6365, September 2011,		DOI 10.17487/RFC6365, September 2011,
	<https://www.rfc-editor.org/info/rfc6365>.		<https://www.rfc-editor.org/info/rfc6365>.
	[RFC7235] Fielding, R., Ed. and J. F. Reschke, Ed., "Hypertext
	Transfer Protocol (HTTP/1.1): Authentication", RFC 7235,
	DOI 10.17487/RFC7235, June 2014,
	<https://www.rfc-editor.org/info/rfc7235>.
	[RFC8187] Reschke, J. F., "Indicating Character Encoding and
	Language for HTTP Header Field Parameters", RFC 8187,
	DOI 10.17487/RFC8187, September 2017,
	<https://www.rfc-editor.org/info/rfc8187>.
	[XMLHttpRequest]		[XMLHttpRequest]
	WhatWG, "XMLHttpRequest", <https://xhr.spec.whatwg.org/>.		WhatWG, "XMLHttpRequest", <https://xhr.spec.whatwg.org/>.
	Appendix A. Examples		10.3. Specifications Using This Syntax (at some point of time)
	This section shows how some of the existing HTTP header fields would
	look like if they would use the format defined by this specification.
	A.1. Content-Length
	"Content-Length" is defined in Section 3.3.2 of [RFC7230], with the
	field value's ABNF being:
	Content-Length = 1*DIGIT
	So the field value is similar to a JSON number ([RFC8259],
	Section 6).
	Content-Length is restricted to a single field instance, as it
	doesn't use the list production (as per Section 3.2.2 of [RFC7230]).
	However, in practice multiple instances do occur, and the definition
	of the header field does indeed discuss how to handle these cases.
	If Content-Length was defined using the JSON format discussed here,
	the ABNF would be something like:
	Content-Length = #number
	; number: [RFC8259], Section 6
	...and the prose definition would:
	* restrict all numbers to be non-negative integers without
	fractions, and
	* require that the array of values is of length 1 (but allow the
	case where the array is longer, but all members represent the same
	value)
	A.2. Content-Disposition
	Content-Disposition field values, defined in [RFC6266], consist of a
	"disposition type" (a string), plus multiple parameters, of which at
	least one ("filename") sometime needs to carry non-ASCII characters.
	For instance, the first example in Section 5 of [RFC6266]:
	Attachment; filename=example.html
	has a disposition type of "Attachment", with filename parameter value
	"example.html". A JSON representation of this information might be:
	{
	"Attachment": {
	"filename" : "example.html"
	}
	}
	which would translate to a header field value of:
	{ "Attachment": { "filename" : "example.html" } }
	The third example in Section 5 of [RFC6266] uses a filename parameter
	containing non-US-ASCII characters:
	attachment; filename*=UTF-8''%e2%82%ac%20rates
	Note that in this case, the "filename*" parameter uses the encoding
	defined in [RFC8187], representing a filename starting with the
	Unicode character "€" (EURO SIGN, U+20AC), followed by " rates". If
	the definition of Content-Disposition would have used the format
	proposed here, the workaround involving the "parameter*" syntax would
	not have been needed at all.
	The JSON representation of this value could then be:
	{ "attachment": { "filename" : "\u20AC rates" } }
	A.3. WWW-Authenticate
	The WWW-Authenticate header field value is defined in Section 4.1 of
	[RFC7235] as a list of "challenges":
	WWW-Authenticate = 1#challenge
	...where a challenge consists of a scheme with optional parameters:
	challenge = auth-scheme [ 1*SP ( token68 / #auth-param ) ]
	An example for a complex header field value given in the definition
	of the header field is:
	Newauth realm="apps", type=1, title="Login to \"apps\"",
	Basic realm="simple"
	(line break added for readability)
	A possible JSON representation of this field value would be the array
	below:
	[
	{
	"Newauth" : {
	"realm": "apps",
	"type" : 1,
	"title" : "Login to \"apps\""
	}
	},
	{
	"Basic" : {
	"realm": "simple"
	}
	}
	]
	...which would translate to a header field value of:
	{ "Newauth" : { "realm": "apps", "type" : 1,
	"title": "Login to \"apps\"" }},
	{ "Basic" : { "realm": "simple"}}
	A.4. Accept-Encoding
	The Accept-Encoding header field value is defined in Section 5.3.4 of
	[RFC7231] as a list of codings, each of which allowing a weight
	parameter 'q':
	Accept-Encoding = #( codings [ weight ] )
	codings = content-coding / "identity" / "*"
	weight = OWS ";" OWS "q=" qvalue
	qvalue = ( "0" [ "." 0*3DIGIT ] )
	/ ( "1" [ "." 0*3("0") ] )
	An example for a complex header field value given in the definition
	of the header field is:
	gzip;q=1.0, identity; q=0.5, *;q=0
	Due to the defaulting rules for the quality value ([RFC7231],
	Section 5.3.1), this could also be written as:
	gzip, identity; q=0.5, *; q=0
	A JSON representation could be:
	[
	{
	"gzip" : {
	}
	},
	{
	"identity" : {
	"q": 0.5
	}
	},
	{
	"*" : {
	"q": 0
	}
	}
	]
	...which would translate to a header field value of:
	{"gzip": {}}, {"identity": {"q": 0.5}}, {"*": {"q": 0}}
	In this example, the part about "gzip" appears unnecessarily verbose,
	as the value is just an empty object. A simpler notation would
	collapse members like these to string literals:
	"gzip", {"identity": {"q": 0.5}}, {"*": {"q": 0}}
	If this is desirable, the header field definition could allow both		[CLEARSITE]
	string literals and objects, and define that a mere string literal		West, M., "Clear Site Data", W3C Working Draft WD-clear-
	would be mapped to a member whose name is given by the string		site-data-20171130, November 30, 2017,
	literal, and the value is an empty object.		<https://www.w3.org/TR/2017/WD-clear-site-data-20171130/>.
			Latest version available at <https://www.w3.org/TR/clear-
			site-data/>.
	For what it's worth, one of the most common cases for 'Accept-		[FEATUREPOL]
	Encoding' would become:		Clelland, I., "Feature Policy", W3C Editor's Draft ,
			<https://w3c.github.io/webappsec-feature-policy/>.
	"gzip", "deflate"		[REPORTING]
			Creager, D., Grigorik, I., Meyer, P., and M. West,
			"Reporting API", W3C Working Draft WD-reporting-
			1-20180925, September 25, 2018,
			<https://www.w3.org/TR/2018/WD-reporting-1-20180925/>.
			Latest version available at <https://www.w3.org/TR/
			reporting-1/>.
	which would be only a small overhead over the original format.		Appendix A. Use of JSON Field Value Encoding in the Wild
	Appendix B. Use of JSON Field Value Encoding in the Wild		This section is to be removed before publishing as an RFC.
	Since work started on this document, various specifications have		Since work started on this document, various specifications have
	adopted this format. At least one of these moved away after the HTTP		adopted this format. At least one of these moved away after the HTTP
	Working Group decided to focus on [HSTRUCT] (see thread starting at		Working Group decided to focus on [HSTRUCT] (see thread starting at
	https://lists.w3.org/Archives/Public/ietf-http-		<https://lists.w3.org/Archives/Public/ietf-http-
	wg/2016OctDec/0505.html).		wg/2016OctDec/0505.html>).
	The sections below summarize the current usage of this format.		The sections below summarize the current usage of this format.
	B.1. W3C Reporting API Specification		A.1. W3C Reporting API Specification
	Defined in W3C Working Draft "Reporting API" (Section 3.1 of		Defined in W3C Working Draft "Reporting API" (Section 3.1 of
	[REPORTING]). Still in use in latest working draft dated September		[REPORTING]). Still in use in latest working draft dated September
	2018.		2018.
	B.2. W3C Clear Site Data Specification		A.2. W3C Clear Site Data Specification
	Used in earlier versions of "Clear Site Data". The current version		Used in earlier versions of "Clear Site Data". The current version
	replaces the use of JSON with a custom syntax that happens to be		replaces the use of JSON with a custom syntax that happens to be
	somewhat compatible with an array of JSON strings (see Section 3.1 of		somewhat compatible with an array of JSON strings (see Section 3.1 of
	[CLEARSITE] and https://lists.w3.org/Archives/Public/ietf-http-		[CLEARSITE] and <https://lists.w3.org/Archives/Public/ietf-http-
	wg/2017AprJun/0214.html for feedback).		wg/2017AprJun/0214.html> for feedback).
	B.3. W3C Feature Policy Specification
	Originally defined in W3C Draft Community Group Report "Feature
	Policy" ([FEATUREPOL]), but now replaced with a custom syntax (see
	https://github.com/WICG/feature-policy/pull/83).
	Appendix C. Relation to HTTP 'Key' Header Field
	[KEY] aims to improve the cacheability of responses that vary based
	on certain request header fields, addressing lack of granularity in
	the existing "Vary" response header field ([RFC7231], Section 7.1.4).
	If the JSON-based format described by this document gains popularity,
	it might be useful to add a JSON-aware "Key Parameter" (see
	Section 2.3 of [KEY]).
	Appendix D. Discussion
	This approach uses a default of "JSON array", using implicit array
	markers. An alternative would be a default of "JSON object". This
	would simplify the syntax for non-list-typed header fields, but all
	the benefits of having the same data model for both types of header
	fields would be gone. A hybrid approach might make sense, as long as
	it doesn't require any heuristics on the recipient's side.
	| *Note:* a concrete proposal was made by Kazuho Oku in		A.3. W3C Feature Policy Specification
	| https://lists.w3.org/Archives/Public/ietf-http-
	| wg/2016JanMar/0155.html.
	// Use of generic libs vs compactness of field values..		Originally defined in W3C document "Feature Policy" ([FEATUREPOL]),
			but switched to use of Structured Header Fields ([HSTRUCT]).
	Appendix E. Change Log		Appendix B. Change Log
	This section is to be removed before publishing as an RFC.		This section is to be removed before publishing as an RFC.
	E.1. Since draft-reschke-http-jfv-00		B.1. Since draft-reschke-http-jfv-00
	Editorial fixes + working on the TODOs.		Editorial fixes + working on the TODOs.
	E.2. Since draft-reschke-http-jfv-01		B.2. Since draft-reschke-http-jfv-01
	Mention slightly increased risk of smuggling information in header		Mention slightly increased risk of smuggling information in header
	field values.		field values.
	E.3. Since draft-reschke-http-jfv-02		B.3. Since draft-reschke-http-jfv-02
	Mention Kazuho Oku's proposal for abbreviated forms.		Mention Kazuho Oku's proposal for abbreviated forms.
	Added a bit of text about the motivation for a concrete JSON subset		Added a bit of text about the motivation for a concrete JSON subset
	(ack Cory Benfield).		(ack Cory Benfield).
	Expand I18N section.		Expand I18N section.
	E.4. Since draft-reschke-http-jfv-03		B.4. Since draft-reschke-http-jfv-03
	Mention relation to KEY header field.		Mention relation to KEY header field.
	E.5. Since draft-reschke-http-jfv-04		B.5. Since draft-reschke-http-jfv-04
	Between June and December 2016, this was a work item of the HTTP		Between June and December 2016, this was a work item of the HTTP
	working group (see https://datatracker.ietf.org/doc/draft-ietf-		working group (see <https://datatracker.ietf.org/doc/draft-ietf-
	httpbis-jfv/). Work (if any) continues now on		httpbis-jfv/>). Work (if any) continues now on
	https://datatracker.ietf.org/doc/draft-reschke-http-jfv/.		<https://datatracker.ietf.org/doc/draft-reschke-http-jfv/>.
	Changes made while this was a work item of the HTTP Working Group:		Changes made while this was a work item of the HTTP Working Group:
	E.6. Since draft-ietf-httpbis-jfv-00		B.6. Since draft-ietf-httpbis-jfv-00
	Added example for "Accept-Encoding" (inspired by Kazuho's feedback),		Added example for "Accept-Encoding" (inspired by Kazuho's feedback),
	showing a potential way to optimize the format when default values		showing a potential way to optimize the format when default values
	apply.		apply.
	E.7. Since draft-ietf-httpbis-jfv-01		B.7. Since draft-ietf-httpbis-jfv-01
	Add interop discussion, building on I-JSON and ECMA-262 (see		Add interop discussion, building on I-JSON and ECMA-262 (see
	https://github.com/httpwg/http-extensions/issues/225).		<https://github.com/httpwg/http-extensions/issues/225>).
	E.8. Since draft-ietf-httpbis-jfv-02		B.8. Since draft-ietf-httpbis-jfv-02
	Move non-essential parts into appendix.		Move non-essential parts into appendix.
	Updated XHR reference.		Updated XHR reference.
	E.9. Since draft-reschke-http-jfv-05		B.9. Since draft-reschke-http-jfv-05
	Add meat to "Using this Format in Header Field Definitions".		Add meat to "Using this Format in Header Field Definitions".
	Add a few lines on the relation to "Key".		Add a few lines on the relation to "Key".
	Summarize current use of the format.		Summarize current use of the format.
	E.10. Since draft-reschke-http-jfv-06		B.10. Since draft-reschke-http-jfv-06
	RFC 5987 is obsoleted by RFC 8187.		RFC 5987 is obsoleted by RFC 8187.
	Update CLEARSITE comment.		Update CLEARSITE comment.
	E.11. Since draft-reschke-http-jfv-07		B.11. Since draft-reschke-http-jfv-07
	Update JSON and HSTRUCT references.		Update JSON and HSTRUCT references.
	FEATUREPOL doesn't use JSON syntax anymore.		FEATUREPOL doesn't use JSON syntax anymore.
	E.12. Since draft-reschke-http-jfv-08		B.12. Since draft-reschke-http-jfv-08
	Update HSTRUCT reference.		Update HSTRUCT reference.
	Update notes about CLEARSITE and FEATUREPOL.		Update notes about CLEARSITE and FEATUREPOL.
	E.13. Since draft-reschke-http-jfv-09		B.13. Since draft-reschke-http-jfv-09
	Update HSTRUCT and FEATUREPOL references.		Update HSTRUCT and FEATUREPOL references.
	Update note about REPORTING.		Update note about REPORTING.
	Changed category to "informational".		Changed category to "informational".
	E.14. Since draft-reschke-http-jfv-10		B.14. Since draft-reschke-http-jfv-10
	Update HSTRUCT reference.		Update HSTRUCT reference.
			B.15. Since draft-reschke-http-jfv-11
			Update HSTRUCT reference.
			Update note about FEATUREPOL (now using Structured Fields).
			Reference [HTTP] instead if RFC723* and adjust (header) field
			terminology accordingly.
			Remove discussion about the relation to KEY (as that spec is dormant:
			<https://datatracker.ietf.org/doc/draft-ietf-httpbis-key/>).
			Remove appendices "Examples" and "Discussion".
			Mark "Use of JSON Field Value Encoding in the Wild" for removal in
			RFC.
	Acknowledgements		Acknowledgements
	Thanks go to the Hypertext Transfer Protocol Working Group		Thanks go to the Hypertext Transfer Protocol Working Group
	participants.		participants.
	Author's Address		Author's Address
	Julian F. Reschke		Julian F. Reschke
	greenbytes GmbH		greenbytes GmbH
	Hafenweg 16		Hafenweg 16
End of changes. 74 change blocks.
	388 lines changed or deleted		173 lines changed or added
This html diff was produced by rfcdiff 1.45. The latest version is available from http://tools.ietf.org/tools/rfcdiff/