W3C home > Mailing lists > Public > public-rdf-dawg@w3.org > January to March 2006

Re: URI serialization issues

From: Kendall Clark <kendall@monkeyfist.com>
Date: Tue, 17 Jan 2006 11:47:08 -0500
Message-Id: <6AAC46C6-E15B-4055-A6B8-5C93D765927D@monkeyfist.com>
Cc: dawg comments <public-rdf-dawg-comments@w3.org>, dawg mailing list <public-rdf-dawg@w3.org>
To: Mark Baker <distobj@acm.org>

On Jan 17, 2006, at 11:34 AM, Mark Baker wrote:

> In the HTTP binding part of the protocol[1], the advice as to whether
> or not a URI serialization for the query is suitable is given as;
> "The GET binding should be used except in cases where the URL-encoded
> query exceeds practicable limits, in which case the POST binding
> should be used."
> Due to the considerations in the "security" section about possible
> denial-of-service attacks, combined with the assumed "do no harm"
> (safety) aspect of GET, I think it's quite reasonable for a service
> provider not to expose potentially expensive queries via URI+GET.
> I still like the idea of a SHOULD-level requirement for using URIs
> though, so perhaps something like this could be said;
> "The GET binding SHOULD be used except in the following cases, in
> which case the POST binding SHOULD be used;
>   o where the URL-encoded query exceeds practicable length limits
>   o where the cost of processing the query may be prohibitive (see
> Section 3.1, "Security")"

We just voted to publish a new LC protocol document. But I favor this  
patch, so I'll see if I can get it worked into this LC cycle. If not,  
I suspect it could appear later. At least, I'd favor it so appearing.

Received on Tuesday, 17 January 2006 16:47:22 UTC

This archive was generated by hypermail 2.3.1 : Wednesday, 7 January 2015 15:00:50 UTC