We spent a great deal of time debating this issue and have come to the
following conclusion:
'Allprop' is not the problem - 'depth: infinity' is the problem.
Allprop is a perfectly reasonable, even necessary, request. Any client will
have a need to know about the complete property namespace for a particular
resource. Why then should any sensibly written client need to issue a
propfind request with depth infinity? Even if the server has the capacity
to build such a horrendous response, the response would probably crash the
client when it was received.
Two possible solutions arose from our discussions, about which we would
welcome constructive criticism:
1- propfind should only be required to accept 'depth:0' and 'depth:1'.
Clients who really need more information can then issue requests as needed
to go further into the hierarchy. The client will then receive a '501 Not
implemented' if it attempts something that nasty.
2- if we have to keep 'depth: infinity', it should not be the default.
These suggestions seem reasonable (even ideal!) to us here, but we must
concede that we may be biased by the needs of our own particular project.
Regards
Richard Humphreys
Xerox Europe
