RFC 3348

RFC 3348: The Internet Message Action Protocol (IMAP4) Child Mailbox Extension 💖

okay bestie, this is RFC 3348 🎀 It's from the Network Working Group, written by M. Gahrns and R. Cheng (both at Microsoft), and it's dated July 2002. The category is Informational 🧚, so it's documentation, not a standard. The header has no Obsoletes or Updates lines, so it doesn't replace or change any other RFC ✨

Status of this Memo 📝

This memo gives information to the Internet community. It doesn't specify an Internet standard of any kind, and it can be distributed without limit 🌸

Copyright Notice ©️

Copyright (C) The Internet Society (2002). All Rights Reserved.

Abstract 🦋

The IMAP4 CHILDREN extension gives a client a way to figure out quickly whether a mailbox has children, without sending LIST "" * or LIST "" % for every single mailbox. no cap, that's the whole point 💅

1. Conventions used in this document 📏

In examples, C: and S: mark lines sent by the client and by the server. If a line wraps without a new C: or S: label, the wrapping is only there to make it easier to read. It isn't part of the command.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC-2119]. These are the special capital words, so pay attention to them 👑

2. Introduction and Overview 🌸

Lots of IMAP4 [RFC-2060] clients show the user their mailboxes as a tree 🌳 Showing the whole thing at once is a lot, especially when there are tons of mailboxes, so it's usually nicer to start with a collapsed outline. The user expands it whenever they want to. Most clients put a little visual clue, like a "+", next to any mailbox that has children under it. Click that clue and the list opens up to show the child mailboxes.

Several IMAP vendors already built this, so the proposal is to document this behaviour and functionality as an Informational RFC. It's giving "we already do this, let's write it down" 💜

There's also interest in making the IMAP LIST command more extensible through an IMAP LIST Extension draft. Something like the \HasChildren and \HasNoChildren flags could go into that new LIST Extension. The plan is for the more general LIST Extension draft to move forward on the standards track, while this proposal gets relegated to informational status only 🍓

If the \HasChildren and \HasNoChildren functionality were part of a more general LIST extension, a client could ask whether the server should return this information at all. That would help servers where the information is expensive to compute. The server would only have to work it out when it knew the client could actually use it ✨

3. Requirements ✅

IMAP4 servers that support this extension MUST list the keyword CHILDREN in their CAPABILITY response. That's the bare minimum, bestie 💅

The CHILDREN extension defines two new attributes that MAY be returned within a LIST response.

\HasChildren - The presence of this attribute indicates that the mailbox has child mailboxes.

Servers SHOULD NOT return \HasChildren if child mailboxes exist but none of them will be displayed to the current user in a LIST response. That's the case where child mailboxes exist but a client doesn't have permission to access them. In that situation, \HasNoChildren SHOULD be used 🙈

Sometimes a server can't efficiently work out whether a user can access all the child mailboxes. Also, multiple users might be using the same account and changing the mailbox hierarchy at the same time. So a client MUST be prepared to accept the \HasChildren attribute as a hint. A mailbox MAY be flagged with \HasChildren, but then no child mailboxes will show up in a later LIST response. it's a hint, not a promise 🫶

Example 3.1:

Example 3.1:
============

/*** Consider a server that has the following mailbox hierarchy:

INBOX
ITEM_1
   ITEM_1A
ITEM_2
   TOP_SECRET

Where INBOX, ITEM_1 and ITEM_2 are top level mailboxes.  ITEM_1A is a
child mailbox of ITEM_1 and TOP_SECRET is a child mailbox of ITEM_2
that the currently logged on user does NOT have access to.

Note that in this case, the server is not able to efficiently compute
access rights to child mailboxes and responds with a \HasChildren
attribute for mailbox ITEM_2, even though ITEM_2/TOP_SECRET does not
appear in the list response.  ***/

C: A001 LIST "" *
S: * LIST (\HasNoChildren) "/" INBOX
S: * LIST (\HasChildren) "/" ITEM_1
S: * LIST (\HasNoChildren) "/" ITEM_1/ITEM_1A
S: * LIST (\HasChildren) "/" ITEM_2
S: A001 OK LIST Completed

\HasNoChildren - The presence of this attribute indicates that the mailbox has NO child mailboxes that the currently authenticated user can access. If a mailbox has the \Noinferiors attribute, then \HasNoChildren is redundant and SHOULD be omitted in the LIST response 🧹

Sometimes a server that supports the CHILDREN extension MAY NOT be able to tell whether a mailbox has children. For example, it might struggle to figure that out when it's listing mailboxes in a particular namespace 🤷‍♀️

In those cases, a server MAY exclude both the \HasChildren and \HasNoChildren attributes from the LIST response. So a client can NOT assume anything about whether a mailbox has children just because one of those attributes is missing don't fall for it, bestie 🚫

It is an error for the server to return both a \HasChildren and a \HasNoChildren attribute in a LIST response.

It is an error for the server to return both a \HasChildren and a \NoInferiors attribute in a LIST response.

Note: the \HasNoChildren attribute should not be confused with the IMAP4 [RFC-2060] attribute \Noinferiors. That one means no child mailboxes exist now, and none can be created in the future. Different vibes, totally different things 🦋

The \HasChildren and \HasNoChildren attributes might not be returned in response to an LSUB response. Lots of servers keep a simple subscription list that doesn't get updated when the underlying mailbox structure changes. A client MUST NOT assume that hierarchy information will be kept in the subscription list 💀

RLIST is a command defined in [RFC-2193]. It includes mailboxes in a LIST response that can only be reached through a referral. So a client has to explicitly send an RLIST command to see those mailboxes. If a mailbox has child mailboxes that are only available by referral, those mailboxes would show up as \HasNoChildren in response to the LIST command, and as \HasChildren in response to the RLIST command 🧚

5. Formal Syntax 🧾

The following syntax specification uses the augmented Backus-Naur Form (BNF) as described in [ABNF].

Two new mailbox attributes are defined as flag_extensions to the IMAP4 mailbox_list response:

HasChildren = "\HasChildren"

HasNoChildren = "\HasNoChildren"

6. Security Considerations 🔐

This is serious, so please pay attention 🥺 This extension gives a client a more efficient way to find out whether a particular mailbox has children. If a mailbox has children, but the currently authenticated user can't access any of them, the server SHOULD respond with a \HasNoChildren attribute.

But a server often can't efficiently work out whether a user can access all the child mailboxes. If that server responds with \HasChildren when the currently authenticated user can't access any child mailboxes at all, it can reveal more about the mailbox than was intended. A server built with that level of security in mind SHOULD NOT attach the \HasChildren attribute to a mailbox unless it's certain the user can access at least one of the child mailboxes. leaking hidden folders is NOT the vibe 💀

7. References 📚

• [RFC-2060] Crispin, M., "Internet Message Access Protocol - Version 4rev1", RFC 2060, December 1996.
• [RFC-2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
• [RFC-2234] Crocker, D. and P. Overell, Editors, "Augmented BNF for Syntax Specifications: ABNF", RFC 2234, November 1997.
• [RFC-2193] Gahrns, M., "IMAP4 Mailbox Referrals", RFC 2193, September 1997.

8. Acknowledgments 💌

The authors want to thank the people at several IMC Mail Connect events. They gave input when this idea was first presented and when it got refined 🫶

9. Author's Address 📮

Mike Gahrns
Microsoft
One Microsoft Way
Redmond, WA, 98052
Phone: (425) 936-9833
EMail: mikega@microsoft.com

Raymond Cheng
Microsoft
One Microsoft Way
Redmond, WA, 98052
Phone: (425) 703-4913
EMail: raych@microsoft.com

10. Full Copyright Statement ⚖️

Copyright (C) The Internet Society (2002). All Rights Reserved.

This document and translations of it may be copied and furnished to others. Derivative works that comment on or otherwise explain it, or help with its implementation, may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind. This is allowed as long as the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations. The exception is when it's needed for developing Internet standards, in which case the procedures for copyrights defined in the Internet Standards process must be followed. Translating it into languages other than English is also allowed.

The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.

This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement 🌈

Funding for the RFC Editor function is currently provided by the Internet Society.