Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Missing changes - determining target URI authority #1104

Open
amichair opened this issue Apr 14, 2023 · 0 comments
Open

Missing changes - determining target URI authority #1104

amichair opened this issue Apr 14, 2023 · 0 comments

Comments

@amichair
Copy link

In RFC 7230 section 5.5 (Effective Request URI):

If the server's configuration (or outbound gateway) provides a
fixed URI authority component, that authority is used for the
effective request URI. If not, then if the request-target is in
authority-form, the effective request URI's authority component is
the same as the request-target. If not, then if a Host header
field is supplied with a non-empty field-value, the authority
component is the same as the Host field-value. Otherwise, the
authority component is assigned the default name configured for
the server and, if the connection's incoming TCP port number
differs from the default port for the effective request URI's
scheme, then a colon (":") and the incoming port number (in
decimal form) are appended to the authority component.

whereas in RFC 9112 section 3.3 (Reconstructing the Target URI) it is reduced to:

If the request-target is in authority-form, the target URI's authority component is the request-target. Otherwise, the target URI's authority component is the field value of the Host header field. If there is no Host header field or if its field value is empty or invalid, the target URI's authority component is empty.

So both the first step (configured fixed authority) and the last step (default server name plus connection's port) have been removed. Also, it is implied that it used to never be empty (always fallback on the default name), whereas now it can be explicitly empty.

This should be mentioned in the "Changes from RFC 7230" section of the new RFC.

Also, it would help to clarify what it means if the authority is empty (e.g. how does one construct a redirect url based on it if there is no authority? or should the request always be rejected if empty? etc.).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

1 participant