Subject: [webfinger] Why was the HEAD method added to WebFinger in -13?

From: Mike Jones <[email-masked]>
Date: Wed, 17 Apr 2013 17:30:07 +0000

WebFinger -13 added this paragraph:

A WebFinger client MAY utilize the HEAD method when querying a WebFinger resource.  Consequently, a WebFinger resource MUST support the receipt of the HEAD method.

At least as I see it, this just increased the required implementation footprint of WebFinger servers for no particular apparent gain.  I'm curious why this was added and whether others think that it's actually necessary or useful.

                                                                Thanks,

                                                                -- Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Paul E. Jones
Sent: Tuesday, April 16, 2013 7:56 PM
To: [email-masked]
Subject: [webfinger] FW: New Version Notification - draft-ietf-appsawg-webfinger-13.txt

FYI

> -----Original Message-----

> From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]

> Sent: Tuesday, April 16, 2013 10:54 PM

> To: [email-masked]<mailto:[email-masked]>; draft-ietf-appsawg-

> [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>;

> [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>;

> [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>

> Subject: New Version Notification -

> draft-ietf-appsawg-webfinger-13.txt

> A new version (-13) has been submitted for draft-ietf-appsawg-webfinger:

> http://www.ietf.org/internet-drafts/draft-ietf-appsawg-webfinger-13.tx

> t

> Sub state has been changed to AD Followup from Revised ID Needed

> The IETF datatracker page for this Internet-Draft is:

> https://datatracker.ietf.org/doc/draft-ietf-appsawg-webfinger/

> Diff from previous version:

> http://www.ietf.org/rfcdiff?url2=draft-ietf-appsawg-webfinger-13

> IETF Secretariat.

_______________________________________________

webfinger mailing list

[email-masked]<mailto:[email-masked]>

https://www.ietf.org/mailman/listinfo/webfinger

---

From: Barry Leiba <[email-masked]>
Date: Wed, 17 Apr 2013 14:10:27 -0400

Mike, you have not followed the discussion outline: this isn't sent to
sufficient recipients to get to the right people.

+++ ACTION: Appsawg Chairs +++
I've added more recipients here, and this is asking the appsawg chairs
to add this to the issue list, to be brought up in its turn.  Please
see my messages about the DISCUSS positions to get the discussion
parameters.

Thanks,
Barry

On Wed, Apr 17, 2013 at 1:30 PM, Mike Jones <[email-masked]> wrote:
> A WebFinger client MAY utilize the HEAD method when querying a WebFinger
> resource.  Consequently, a WebFinger resource MUST support the receipt of
> the HEAD method.
>
>
>
> At least as I see it, this just increased the required implementation
> footprint of WebFinger servers for no particular apparent gain.  I’m curious
> why this was added and whether others think that it’s actually necessary or
> useful.
>
>
>
>                                                                 Thanks,
>
>                                                                 -- Mike
>
>
>
>> From: [email-masked] [mailto:[email-masked]]
>
>> To: [email-masked]; draft-ietf-appsawg-
>
>> [email-masked]; [email-masked];
>
>> [email-masked]; [email-masked]; [email-masked];
>
>> [email-masked]; [email-masked]
>
> [email-masked]
> [email-masked]

---

From: Richard Barnes <[email-masked]>
Date: Wed, 17 Apr 2013 14:49:50 -0400

Mike,

The back story is this:
-- My DISCUSS asked what methods should be allowed / required to a
WebFinger URI
-- Obviously GET is required
-- Paul suggested that HEAD would also be useful

Personally, I'm not sold on the utility of HEAD, especially as a MUST for
servers.

On the other hand, it occurs to me that servers will need to support
OPTIONS for CORS pre-flight checks [1].

--Richard

[1] <http://www.w3.org/TR/cors/#cross-origin-request-with-preflight-0>

---

From: "Paul E. Jones" <[email-masked]>
Date: Thu, 18 Apr 2013 03:20:33 -0400

Richard,

I would not go so far as to say I thought it was a good idea.  I did say, in
response to your proposal to expand on the methods allowed, that we probably
ought not preclude HEAD.  That said, I do agree with Mike on this.
Personally, I'd rather say nothing about HEAD or other methods.  The only
reason I did say we ought not preclude it is that I can imagine some
browsers trying to use it to see if the cache needs refreshing.  So, I
didn't want to forbid it, but I did feel mandating it was a bit much.  The
problem I faced when I inserted that text is that if we want to explicitly
allow the client to send it, we have to have a statement about the server.

I vote to strike the last paragraph in 4.2 relating to HEAD.  If it's
implemented, fine.  If not, browsers should recover.

For CORS, is a preflight request required when using a "simple method" (GET
and HEAD both are).  The text seems to suggest in the introduction that
preflight checks are for non-simple methods (both in section 1 and section
6.2).

Paul

From: Richard Barnes [mailto:[email-masked]] 
Sent: Wednesday, April 17, 2013 2:50 PM
To: Barry Leiba
Cc: Mike Jones; [email-masked];
[email-masked]; [email-masked]; IESG
Subject: Re: [webfinger] Why was the HEAD method added to WebFinger in -13?

Mike,

The back story is this:

-- My DISCUSS asked what methods should be allowed / required to a WebFinger
URI

On the other hand, it occurs to me that servers will need to support OPTIONS
for CORS pre-flight checks [1].

--Richard

 

On Wed, Apr 17, 2013 at 2:10 PM, Barry Leiba <[email-masked]>
wrote:

Thanks,
Barry

On Wed, Apr 17, 2013 at 1:30 PM, Mike Jones <[email-masked]>
wrote:
> footprint of WebFinger servers for no particular apparent gain.  I'm
curious
> why this was added and whether others think that it's actually necessary
or

---

From: Richard Barnes <[email-masked]>
Date: Thu, 18 Apr 2013 12:45:40 -0400

Sorry if I overstated your position.

That's a good point that CORS pre-flight is not required for GET/HEAD.
 There might be some concern about non-simple headers.  So it seems servers
might still want to support it.

How about the following change?

OLD:
"""
"""

NEW:
"""
WebFinger clients MAY perform HEAD requests to a WebFinger resource.  For
example, a HEAD request could be used to see if a cache needs refreshing.
 Clients MAY also send CORS pre-flight requests (if a request uses
non-simple headers), which use the HTTP OPTIONS method. Servers SHOULD
support the HEAD and OPTIONS methods for WebFinger resources.
"""

On Thu, Apr 18, 2013 at 3:20 AM, Paul E. Jones <[email-masked]>wrote:

> Richard,****
>
> ** **
>
> I would not go so far as to say I thought it was a good idea.  I did say,
> in response to your proposal to expand on the methods allowed, that we
> probably ought not preclude HEAD.  That said, I do agree with Mike on
> this.  Personally, I’d rather say nothing about HEAD or other methods.  The
> only reason I did say we ought not preclude it is that I can imagine some
> didn’t want to forbid it, but I did feel mandating it was a bit much.  The
> ****
> ** **
> I vote to strike the last paragraph in 4.2 relating to HEAD.  If it’s
> implemented, fine.  If not, browsers should recover.****
>
> ** **
>
> For CORS, is a preflight request required when using a “simple method”
> (GET and HEAD both are).  The text seems to suggest in the introduction
> that preflight checks are for non-simple methods (both in section 1 and
> section 6.2).****
>
> ** **
>
> Paul****
>
> ** **
>
> *From:* Richard Barnes [mailto:[email-masked]]
> *Sent:* Wednesday, April 17, 2013 2:50 PM
> *To:* Barry Leiba
> *Cc:* Mike Jones; [email-masked];
> *Subject:* Re: [webfinger] Why was the HEAD method added to WebFinger in
> -13?****
>
> ** **
>
> Mike,****
>
> ** **
>
> The back story is this:****
>
> WebFinger URI****
> -- Obviously GET is required****
>
> -- Paul suggested that HEAD would also be useful****
>
> ** **
>
> servers.****
> ** **
> OPTIONS for CORS pre-flight checks [1].****
>
> ** **
>
> --Richard****
>
> ** **
>
> [1] <http://www.w3.org/TR/cors/#cross-origin-request-with-preflight-0>****
>
> ** **
>
> ** **
>
> ** **
>
> ** **
>
> wrote:****
> >****
> ** **

---

From: John Bradley <[email-masked]>
Date: Fri, 19 Apr 2013 11:15:30 -0300

Yes that is reasonable. 

Sent from my iPhone

On 2013-04-18, at 1:45 PM, Richard Barnes <[email-masked]> wrote:

> That's a good point that CORS pre-flight is not required for GET/HEAD.  There might be some concern about non-simple headers.  So it seems servers might still want to support it.
> 
> WebFinger clients MAY perform HEAD requests to a WebFinger resource.  For example, a HEAD request could be used to see if a cache needs refreshing.  Clients MAY also send CORS pre-flight requests (if a request uses non-simple headers), which use the HTTP OPTIONS method. Servers SHOULD support the HEAD and OPTIONS methods for WebFinger resources.
> """
> 
> 
> 
> 
> On Thu, Apr 18, 2013 at 3:20 AM, Paul E. Jones <[email-masked]> wrote:
>> Richard,
>> 
>>  
>> 
>> I would not go so far as to say I thought it was a good idea.  I did say, in response to your proposal to expand on the methods allowed, that we probably ought not preclude HEAD.  That said, I do agree with Mike on this.  Personally, I’d rather say nothing about HEAD or other methods.  The only reason I did say we ought not preclude it is that I can imagine some browsers trying to use it to see if the cache needs refreshing.  So, I didn’t want to forbid it, but I did feel mandating it was a bit much.  The problem I faced when I inserted that text is that if we want to explicitly allow the client to send it, we have to have a statement about the server.
>> 
>>  
>> 
>> I vote to strike the last paragraph in 4.2 relating to HEAD.  If it’s implemented, fine.  If not, browsers should recover.
>> 
>>  
>> 
>> For CORS, is a preflight request required when using a “simple method” (GET and HEAD both are).  The text seems to suggest in the introduction that preflight checks are for non-simple methods (both in section 1 and section 6.2).
>> 
>>  
>> 
>> Paul
>> 
>>  
>> 
>> Cc: Mike Jones; [email-masked]; [email-masked]; [email-masked]; IESG
>> -- My DISCUSS asked what methods should be allowed / required to a WebFinger URI
>> 
>> Personally, I'm not sold on the utility of HEAD, especially as a MUST for servers.
>> 
>>  
>> 
>> On the other hand, it occurs to me that servers will need to support OPTIONS for CORS pre-flight checks [1].
>> 
>>  
>> 
>> --Richard
>> 
>>  
>> 
>> On Wed, Apr 17, 2013 at 2:10 PM, Barry Leiba <[email-masked]> wrote:
>>