Re: #282: Recommend minimum sizes for protocol elements

OK, I've set the milestone for this to -15.


On 26/06/2011, at 5:03 PM, Mark Nottingham wrote:

> Revised proposal:
> 
> 
> For HTTP headers, insert at end of p1 3.2:
> 
> """
> HTTP does not place a pre-defined limit on the length of header fields, either in isolation or as a set. A server MUST be prepared to receive request headers of unbounded length and respond with the 413 (Request Entity Too Large) status code if the received header(s) would be longer than the server wishes to handle (see Section 8.4.14 of [Part2]).
> 
> A client that receives response headers that are longer than it wishes to handle can only treat it as a server error.
> 
> Various ad-hoc limitations on header length are found in practice. It is RECOMMENDED that all HTTP senders and recipients support messages whose combined header block (i.e., from the start of the request-line or response-line until the CRLF CLRF that terminates the headers) have 4,000 or more octets.
> """
> 
> 
> For max-age and other cache-control directives, move the definition of delta-seconds from Age to a new subsection of p6 1.4 Syntax Notation:
> 
> """
> 1.4.x Delta Seconds
> 
> The delta-seconds rule specifies a non-negative integer, representing time in seconds.
> 
> delta-seconds = 1*DIGIT
> 
> If an implementation receives a delta-seconds value larger than the largest positive integer it can represent, or if any of its subsequent calculations overflows, it MUST consider the value to be 2147483648 (2^31). Recipients parsing a delta-seconds value SHOULD use an arithmetic type of at least 31 bits of range, and senders MUST NOT send delta-seconds with a value greater than 2147483648.
> """
> 
> 
> For other situations, add section to p1 Security Considerations:
> 
> """
> 11.5 Protocol Element Size Overflows
> 
> Because HTTP uses mostly textual, character-delimited fields, attackers can overflow buffers in implementations, and/or perform a Denial of Service against implementations that accept fields with unlimited lengths.
> 
> To promote interoperability, this specification makes specific recommendations for size limits on request-targets [ref] and blocks of header fields [ref]. These are minimum recommendations, chosen to be supportable even by implementations with limited resources; it is expected that most implementations will choose substantially higher limits.
> 
> This specification also provides a way for servers to reject messages that have request-targets that are too long [ref] or request entities that are too large [ref].
> 
> Other fields (including but not limited to request methods, response status phrases, header field-names, and body chunks) SHOULD be limited by implementations carefully, so as to not impede interoperability.
> """

--
Mark Nottingham   http://www.mnot.net/

Received on Tuesday, 28 June 2011 05:08:53 UTC