Re: i69: Clarify "Requested Variant" [was: New "200 OK" status codes, PATCH & PROPFIND]

tis 2008-02-05 klockan 07:33 -0500 skrev Yves Lafon:

> > It should never differ, and only depend on the Request-URI + those request 
> > headers that select the variant.
> 
> But in this case it may apply to another URI than request URI...

In both cases (200 Content-Location + ETag / 201 Location + ETag) & it
does, and both are subject to the same security implications that it's
not always safe to assume the response is authorative for the indicated
resource.

The two is really just two facets of the same concept of indicating that
the action was taken/resulter in a resorce at a different location than
the request-URI, with the main difference being the meaning of the
response entity.

The RFC wording is more strict on this wrt the use of Content-Location
than Location because associating the wrong response entity (+ ETag)
with a resource is a lot more dangerous than associating just a wrong
ETag..

Regards
Henrik

Received on Tuesday, 5 February 2008 13:35:44 UTC