PROXY-REDIRECT status...

Jim Gettys (jg@pa.dec.com)
Thu, 20 Nov 1997 17:13:42 -0800 

I've received mail from both Ari and Josh this evening; it looks like they 
are not going to be able to get an updated version of 306 done (particularly 
since 306 (set proxy) depended on the elaborated OPTIONS spec, we've been 
unable to converge on).

I'm going to remove the changes made in draft 08 (rev-00) for
this issue, though I think I'll add a few words around limiting
305 to origin servers, for a single request. (to deal with the
fundamental security issue 305 raises).  Right now, anyone working
to the last draft silly enough to try to implement it would be doing
more harm than good, so I don't want to leave the rev 00 wording
in Rev 01...

Having said that:

I believe the set proxy functionality is REALLY badly needed for operational 
and web evolution reasons, in my personal opinion.  The sooner the better.

But Set Proxy needs to be done right, because the potential for spoofing 
attacks is very large, and the design work better not be hurried.

Unless/until an updated proposal 306 (set proxy) gets made (and soon) to 
the working group, I'm extremely pessimistic about 306 (set proxy) making 
draft standard of HTTP/1.1.

Even then, one might argue that set proxy is new functionality, and I don't 
want this to hang up getting HTTP/1.1 to draft standard.  So my opinion 
is at this date to undock the set proxy functionality into a separate document. 

We cannot introduce new functionality between proposed standard and draft 
standard, only fix problems found in the proposed standard; as usual IETF 
leaves this to the judgement call of the editor, working group chair, and 
area directors, and ultimately IESG; there is wiggle room, but not infinite 
amounts. In many ways, I'd be happier if the Set Proxy were an independent 
document, particularly at this date.

I suggest more serious thought be made to how to resolve this outside of 
the base HTTP/1.1 specification, sad though that may be, and that we undock 
set proxy.  If people get cracking, such a document could go to proposed
standard, as HTTP/1.1 goes to draft, without risking hanging up HTTP/1.1
going to draft...

			Your editor,

				- Jim Gettys