Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Hosting metadata #11

Closed
martinthomson opened this issue Feb 2, 2016 · 8 comments

Comments

Projects
None yet
3 participants
@martinthomson
Copy link

commented Feb 2, 2016

The draft is complicated significantly by virtue of constructing metadata from three sources:

  1. The original message/response
  2. The metadata in the body of the original response
  3. The protected payload of the secondary resource

(I think that I've gotten the order right here, but I'm not 100%)

If this is truly a content-encoding, then we can retain that property and simplify things greatly. Then the processing rules don't need to concern themselves with header fields at all.

What is the use case for including header fields in the secondary resource?

@reschke

This comment has been minimized.

Copy link
Owner

commented Feb 2, 2016

I agree that it's confusing, but I'm not quit sure which metadata your question is about :-)

Is this about 3) "the protected payload of the secondary resource"? The examples in Section 3.4 use it; 3.4.1 for Content-Language, 3.4.2 for encryption information.

Let's focus on 3.4.2 for now? Are you saying this is wrong/bad?

If we don't need the metadata in the protected payload then we wouldn't need the application/http media type, right?

@martinthomson

This comment has been minimized.

Copy link
Author

commented Feb 3, 2016

3.4.2 is a less informative example, but sure. The Crypto-Key header field, by virtue of its construction, could appear in the header fields of either response and still be effective. Thus, the key could be in the primary resource without any loss of comprehension.

On the basis of 3.4.2 and Crypto-Key, we don't have any justification for metadata in the JSON, nor does it motivate the use of message/http for the payload.

(Crypto-Key could also be added to the outer header fields of the secondary resource. That would make it available, but it would lead to a complete lack of confidentiality. And I don't think that we want to be even looking at those header fields when it comes to constructing the final response.)

@reschke

This comment has been minimized.

Copy link
Owner

commented Feb 4, 2016

Crypto-Key is defined in https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-00#section-4 as:

An Crypto-Key header field can be used to describe the input keying
material used in the Encryption header field.

...
The value or values provided in the Crypto-Key header field is valid
only for the current HTTP message unless additional information
indicates a greater scope.

So I think to make it apply to the secondary resource, some additional text is needed over there.

@reschke

This comment has been minimized.

Copy link
Owner

commented Feb 8, 2016

@martinthomson can you do a sanity-check, in particular on the example using the encryption encoding?

@gaperik

This comment has been minimized.

Copy link

commented Feb 8, 2016

@Julian. This describes OOB without a resource map. How is this
extended/changed in case the origin server provides a resource map, e.g.
using a LINK header? Guess we can describe that elsewhere, e.g. resource
map draft?

2016-02-08 15:26 GMT+01:00 Julian Reschke notifications@github.com:

@martinthomson https://github.com/martinthomson can you do a
sanity-check, in particular on the example using the encryption encoding?


Reply to this email directly or view it on GitHub
#11 (comment).

@reschke

This comment has been minimized.

Copy link
Owner

commented Feb 8, 2016

Yep, that's an orthogonal issue. The resource map either would need to be embedded into the JSON payload, or referenced using a Link header field.

@gaperik

This comment has been minimized.

Copy link

commented Feb 8, 2016

Check.

@reschke

This comment has been minimized.

Copy link
Owner

commented Jun 28, 2016

message encapsulation was removed in draft 03

@reschke reschke closed this Jun 28, 2016

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.