status-code parsing

[annevk]

I looked into status-code a tiny bit and noticed that browsers do not have fully conforming parsers (quelle surprise, I know). I only looked at H/1.

This might not warrant any changes, but if people are writing tests this might be good to take into account, especially for newer versions of HTTP.

whatwg/fetch#1142

[reschke]

Is there anything in the spec that you think needs to change?

[annevk]

I guess it would be nice to at least clarify the range. In particular for:

However, a client MUST understand the class of any status code, as indicated by the first digit, and treat an unrecognized status code as being equivalent to the x00 status code of that class.

The specification talks about classes of status codes, but doesn't seem to deal with the 0xx and 6xx-9xx classes.

And I guess I'm wondering if other clients have similar parsing oddities due to having to copy browser behavior at which point more changes might be warranted.

[reschke]

We currently say:

The first digit of the status code defines the class of response. The last two digits do not have any categorization role. There are five values for the first digit:

1xx (Informational): The request was received, continuing process
2xx (Successful): The request was successfully received, understood, and accepted
3xx (Redirection): Further action needs to be taken in order to complete the request
4xx (Client Error): The request contains bad syntax or cannot be fulfilled
5xx (Server Error): The server failed to fulfill an apparently valid request

Do we really need to say that there are no other classes?

[annevk]

I think the problem is more that nothing says that 600 is not a status code, no? Or how to treat it.

[reschke]

I thought we did say that, but it seems we do not. Good catch.

[royfielding]

Oops, we forgot that status-code needs to be defined in Semantics, not HTTP/1.1. It is defined as 3DIGIT. I think we should explicitly forbid anything that isn't 3DIGIT, along with 0xx.

The other three-digit codes are often used internally by client libraries and web frameworks. I know that's what I did for libwww-perl. Should we reserve those for internal use?

[reschke]

Ack.

Questions:

1. Is a status code a string of length 3 or an integer?
2. Can anything outside the range 100..599 ever be a status code?

[royfielding]

Questions:

1. Is a status code a string of length 3 or an integer?

Yes. (There are no integers in HTTP/1.x, but the values are usually manipulated as integers.)

2. Can anything outside the range 100..599 ever be a status code?

The current requirement is that it be three digits and a client MUST understand the first digit. I don't think we ever forbid the use of codes outside of that range, but we knew that we couldn't define new codes outside of that range because of internal library usage (not on the wire).

We should probably refine this in prose instead of restricting the ABNF.