Re: Sections 3.3.1 and 5.1

Paul Leach wrote:
> 
> 
> 
> >----------
> >From: 	Ben Laurie[SMTP:ben@algroup.co.uk]
> >Subject: 	Sections 3.3.1 and 5.1
> >
> >Section 5.1
> >
> >'The origin server MUST decode the Request-URI in order to properly 
> >interpret the request.  In requests that they forward, proxies MUST NOT
> >
> >rewrite the "abs_path" part of a Request-URI in any way except as noted
> >
> >above to replace a null abs_path with "*". Invalid Request-URIs SHOULD 
> >be responded to with an appropriate status code. Proxies MAY transform 
> >the Request-URI for internal processing purposes, but MUST NOT send
> >such 
> >a transformed Request-URI  in forwarded requests. 
> >Note: This rule ensures that the form of Request-URI is well specified,
> >
> >to enable future extensions without fear that they will break in the 
> >face of some rewritings. One consequence of rewriting the Request-URI
> >is 
> >that integrity or authentication checks by the server may fail. 
> >Implementers should be aware that some pre-HTTP/1.1 proxies have been 
> >known to rewrite the Request-URI.'
> >
> >Speaking as one of those responsible for maintaining the Apache proxy 
> >module, I wonder about the intent of this paragraph - if a proxy is 
> >permitted to rewrite, presumably to make such transformations as a/./b 
> >-> a/b and a/b/../c -> a/c, then it hardly seems fair to allow the 
> >server to interpret them in a different way. Is this what is intended
> >or 
> >are there other kinds of rewriting which it seeks to forbid?
> 
> I don't understand your question -- proxies are NOT permitted to rewrite
> in any way, so the assumption of your "if" sentence is false. And the
> proximate reason is so that inclusion of URLs in authentication
> calculations isn't foiled by proxies rewriting the URLs (as is stated in
> the note at the end of the section you quote).

Proxies are permitted to rewrite internally. I understand the reasoning but
it seems to me that this should be a restrictions on URLs (that is, that they
are always in their canonical form) rather than on proxies.

Cheers,

Ben.

> 
> Paul

-- 
Ben Laurie                  Phone: +44 (181) 994 6435
Freelance Consultant and    Fax:   +44 (181) 994 6472
Technical Director          Email: ben@algroup.co.uk
A.L. Digital Ltd,           URL: http://www.algroup.co.uk
London, England.

Received on Friday, 31 May 1996 14:25:35 UTC