AD Review of draft-ietf-httpbis-compression-dictionary-06

Francesca Palombini <francesca.palombini@ericsson.com> Sun, 07 July 2024 14:08 UTC

Resent-Date: Sun, 07 Jul 2024 14:07:37 +0000
Resent-Message-Id: <E1sQSYD-008BJI-0p@mab.w3.org>
Received-SPF: pass (puck.w3.org: domain of ericsson.com designates 40.107.21.66 as permitted sender) client-ip=40.107.21.66; envelope-from=francesca.palombini@ericsson.com; helo=EUR05-VI1-obe.outbound.protection.outlook.com;
From: Francesca Palombini <francesca.palombini@ericsson.com>
To: "draft-ietf-httpbis-compression-dictionary@ietf.org" <draft-ietf-httpbis-compression-dictionary@ietf.org>, HTTP Working Group <ietf-http-wg@w3.org>
Thread-Topic: AD Review of draft-ietf-httpbis-compression-dictionary-06
Thread-Index: AQHa0Hap5xJwLoYTV0+iSU9y2hIZDw==
Date: Sun, 07 Jul 2024 14:07:20 +0000
Message-ID: <PAXPR07MB78382FD24E0257C79BAAA0C998D92@PAXPR07MB7838.eurprd07.prod.outlook.com>
Accept-Language: en-GB, en-US
Content-Language: en-GB
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: rp/hp1xXGXELoRGo6h4j2l+F/gUyosBLwc81wKEb1iyBjRg0Q3vdaIH5ChqWujfcuu62Zb+efYNEkRnwQkEcSuCPLE//OV/tKVNMieMa1l2qzEm5ibXhvuUU4S2hO9TwaQUl/cwFn4IttTyq+2flANPJtSDkAdpe6mYycsC1cAelx3nRN91mMGqBtIY3nuNpkFKrC9HhN4OfmTXNLatK9s/lBPMGYHlWZkMSCFXuXcV6QFPyWWlkt0dgCZ/WJCLQl4OpkMz1ukBml/gT7IteWJQX68KEOLoe+2oQqVifLGc84TD8fMtkz1xzLYIkJsAAv0JQ7qZvmRLUEN/FTUwyaVtGVRdLnCxpRR9AjZ4tBN+zddfVvy81VCY96N0wM9PNS6JZH7ATaytDBQ/wCv3vRV8LqTb7RKW7OvUFQf+n9mpOc+BhwqUTBfqQTqPVx1RvHOnZ3tcRDQV2h2ysXkCQgYscSQOhBsfKdn9X9vjGd/VfWnHaJ7P8egu9pPSQa+fkwKi9LIEfpubN98fFRjTb1/+HIZwJoTR54KjQTJLxRzucpr+iTkEW8CuvgeEoRcVDixVJ/kU5dm9nb1/BgV/Ot/KuXRQ7swpjx+oJGaHYE0hOJe7NNQqd3wU289HQvesbp3e6OwbjnQGQmQCJzeyiJlrSbE9muV0m1EnaCX0fH4FjUgKgesjAIP+vW/EG4AEtLoo/46vqLbEjZFjEophvz1tzU386PRANnsgJuizMeYIoaYo3OSleNswZ5kQq0Hykv3IGzMEExWGVF+QDycR1XDW5N8ifZkt7przgFaPWJMuQyyGgHeYzXabq73TVVSGpGTSNmh+cYxHSyt9zUBxItVe2E3WxTKbIr9qdCcPPvdBZUHjgRzqoilvMaLzL71Od5+S/kfRBI0iCq4NMcyEeMwnMVTFgoJ8Ap9jfgMq8bi3/BhuqcoMQl64Yz1yyJP80zY8uksPD77+qLAIZ1RwzzDNgpUnIq+dOht45jrKg8A+RMAiO7GFbY/wD7UZaJTXlZA06bGfB0nU3BQBu67sPDwHOwiAYlxjwmGEwdlHqv0pjcEQgtNsJAajJbLMedmlY9knjQ8IGD0/ChCLmt6B/ZMREUzLFMGQLTqPWf4uhpnF+t/xTGumKdt+8UAZdXNVimw0BISOpraMLXrzrQ8Efyr/7sLViTbrQPf519r8fjOknfkkFYFq79AYfMygz1D23mPvxfh/LyViDBFJtRFytZhX5tJBSvvrxzXDvjocaf329jFYlpdUXg2JUdv6fumM+4TFSocfz8hg33oHk22vnO6W851qpmlUgHIGd8SMxpnDj3Qi6l9h4PDXixFB3/7c4vMpsHxgLxbr/n8mTI0PjxyGxOfn89xOj2bHAVDn7SV+cLXQXy00KlZu4gHcJWNMxGTQCn0XYEnE7J/KStmlgF9c/gH4EHyscATD9CMF1pyC9EoNhsw5SIWIikM5q+hMI0CP/zzg/ezxGEwksuePtC8Fj772fnjq0k5MGxzvGvqwr2npXi7pWVtGUkzMTTInW3WUFYgKWdBlG5vlyQg3Q0ArzP1zcKmrGIQzbtnaftRJXxe2A1smmi7Hy5qcuGezqLGGuTw0VkOWlxJUVIhQ+b1+iAwF3IsWT6QQHQi8Oey82ZKLwgaoLmg5APUMlys8l2m0kIQX5SLB/6VzniyZXbdP4F1N9+qFHt3hIuxWKZTQ=
Content-Type: multipart/alternative; boundary="_000_PAXPR07MB78382FD24E0257C79BAAA0C998D92PAXPR07MB7838eurp_"
MIME-Version: 1.0
X-OriginatorOrg: ericsson.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: PAXPR07MB7838.eurprd07.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 677d8b55-a8b3-45bd-36cc-08dc9e8e2119
X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Jul 2024 14:07:25.7304 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: u9RSHtGR2Zma/lZ9ou+mwuo9v6/dS2Os4pAGF+QLPJnwxq4Xlw0wjXxF9BRdRW5uC4j20uW19SrvTxepzJdiN/uBrWav5qsypqU3c9BczBiXLp3VSjV8EGZWcD3ozRTf
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR07MB8005
X-W3C-Hub-DKIM-Status: validation passed: (address=francesca.palombini@ericsson.com domain=ericsson.com), signature is good
X-W3C-Hub-Spam-Status: No, score=-4.1
X-W3C-Hub-Spam-Report: ARC_SIGNED=0.001, ARC_VALID=0.001, BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, DMARC_PASS=-0.001, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, W3C_AA=-1, W3C_WL=-1
X-W3C-Scan-Sig: puck.w3.org 1sQSY9-00Ffo8-24 f52d24250e0eb68df13d0c0f1d03f6bd
X-Original-To: ietf-http-wg@w3.org
Subject: AD Review of draft-ietf-httpbis-compression-dictionary-06
Archived-At: <https://www.w3.org/mid/PAXPR07MB78382FD24E0257C79BAAA0C998D92@PAXPR07MB7838.eurprd07.prod.outlook.com>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/52052
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <https://www.w3.org/email/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>

# AD Review of draft-ietf-httpbis-compression-dictionary-06

cc @fpalombini

Thank you for the work on this document.

Almost all my comments are about references. I think a new version is necessary before starting IETF Last Call, to avoid process issues along the way.

Francesca

## Comments

### Duplicated BCP 14 boilerplate

The boilerplate is duplicate, please remove the second occurrence.

### Structured fields

Can you please update the reference to 8941 to draft-ietf-httpbis-sfbis ? That doc is with the RFC Editor so should not be holding this document up.

Also, I believe the reference to draft-ietf-httpbis-sfbis should be normative, not informative, since terminology from that doc is used. Alternatively, if you want to keep the ref informative, you can import the part of the terminology that is necessary for this doc. I think that's a uglier solution, so I highly prefer sfbis to be made normative, but won't block on it.

### whatwg reference

[URLPattern]
"URL Pattern Standard", March 2024, https://urlpattern.spec.whatwg.org/.

needs to be indicated as Living standard (see RFC 9110 or 9421 for eample of whatwg specs references).

### Fetch missing reference

> The "match-dest" value of the Use-As-Dictionary header is an Inner List of String values that provides a list of request destinations for the dictionary to match (https://fetch.spec.whatwg.org/#concept-request-destination)

> and passes the CORS check (https://fetch.spec.whatwg.org/#cors-check)

Please fix this so that the Fetch spec is properly referenced (normatively is needed, I believe).

### Missing reference

> NOTE: '\' line wrapping per RFC 8792

RFC 8792 should be (informatively) referenced.

### RFC 5861

I agree with Mark's write up, 5861 should really be informative.

## Nits

### Section 2.2.2.

There is several occurrences of {Origin}, please fix.

### CRIME Ref

> The CRIME attack shows that it's a bad idea to compress data from mixed (e.g. public and private) sources

Please add a reference.

### Cookies

> To mitigate any additional tracking concerns, clients MUST treat dictionaries in the same way that they treat cookies.

It would be good to have an informative reference to 6265 (or even 6265bis).

## Notes

This review is in the ["IETF Comments" Markdown format][ICMF], You can use the
[`ietf-comments` tool][ICT] to automatically convert this review into
individual GitHub issues.

[ICMF]: https://github.com/mnot/ietf-comments/blob/main/format.md
[ICT]: https://github.com/mnot/ietf-comments

AD Review of draft-ietf-httpbis-compression-dicti… Francesca Palombini
Re: AD Review of draft-ietf-httpbis-compression-d… Patrick Meenan