RFC 8336

The ORIGIN HTTP/2 Frame

📅 published March 2018, from ietf

RFC 8336: The ORIGIN HTTP/2 Frame 🦋

Okay bestie, the header info first because it's important 💅

Internet Engineering Task Force (IETF) Authors: M. Nottingham and E. Nygren, both from Akamai Technologies 🌸 Category: Standards Track ISSN: 2070-1721 Date: March 2018 Obsoletes/Updates: nothing listed in the header 🤷‍♀️

Abstract

So this doc spells out the ORIGIN frame for HTTP/2 🎀 Its whole job is to tell you which origins are available on a given connection. Main character energy ✨

Status of This Memo

This is an Internet Standards Track document 🌈

It's a product of the Internet Engineering Task Force (IETF), so it reflects what the whole IETF community agrees on. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check out Section 2 of RFC 7841 💜

You can find the current status, any errata, and how to send feedback at https://www.rfc-editor.org/info/rfc8336 🔗

Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved. 🦋

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they were in effect on the date of publication. Please actually read these, because they spell out your rights and restrictions for this document 🙈

If you pull Code Components out of this document, they have to include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions. They come without warranty, as described in the Simplified BSD License itself 💀

Table of Contents

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
  1.1.  Notational Conventions  . . . . . . . . . . . . . . . . .   2
2.  The ORIGIN HTTP/2 Frame . . . . . . . . . . . . . . . . . . .   3
  2.1.  Syntax  . . . . . . . . . . . . . . . . . . . . . . . . .   3
  2.2.  Processing ORIGIN Frames  . . . . . . . . . . . . . . . .   3
  2.3.  The Origin Set  . . . . . . . . . . . . . . . . . . . . .   4
  2.4.  Authority, Push, and Coalescing with ORIGIN . . . . . . .   6
3.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   7
4.  Security Considerations . . . . . . . . . . . . . . . . . . .   7
5.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   8
  5.1.  Normative References  . . . . . . . . . . . . . . . . . .   8
  5.2.  Informative References  . . . . . . . . . . . . . . . . .   8
Appendix A.  Non-Normative Processing Algorithm . . . . . . . . .  10
Appendix B.  Operational Considerations for Servers . . . . . . .  10
Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  11

1. Introduction ✨

So HTTP/2 [RFC7540] lets clients coalesce different origins [RFC6454] onto one connection, as long as certain conditions are met 🫶 But sometimes a connection can't actually be used for a coalesced origin, and that's when the 421 (Misdirected Request) status code ([RFC7540], Section 9.1.2) comes in 🙈

Using that status code does let clients recover from misdirected requests, but it costs latency, and nobody wants that 😭 To fix it, this spec defines a brand new HTTP/2 frame type, "ORIGIN", so servers can say which origins a connection is actually usable for 🎀

Also, experience has shown that HTTP/2's requirement to establish server authority using both DNS and the server's certificate is kinda onerous 💀 So this spec relaxes that: when the ORIGIN frame is in use, clients don't have to check DNS. That comes with extra perks too, like skipping the latency of some DNS lookups 🧚

1.1. Notational Conventions 🌸

Here's the deal with the key words. The BCP 14 key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" are only to be read as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they show up in all capitals, exactly like this 📚 Any other vibe, not a requirement 🙅‍♀️

2. The ORIGIN HTTP/2 Frame 🎀

This doc defines a new HTTP/2 frame type ([RFC7540], Section 4) called ORIGIN. It lets a server tell the client which origin(s) [RFC6454] it'd like the client to treat as members of the Origin Set (Section 2.3) for the connection the frame shows up on 💅

2.1. Syntax 🦋

The ORIGIN frame type is 0xc (decimal 12), and it holds zero or more instances of the Origin-Entry field 🧩

+-------------------------------+-------------------------------+
|         Origin-Entry (*)                                    ...
+-------------------------------+-------------------------------+

An Origin-Entry is a length-delimited string 🍓

+-------------------------------+-------------------------------+
|         Origin-Len (16)       | ASCII-Origin?               ...
+-------------------------------+-------------------------------+

Here's what's in there, specifically:

  • Origin-Len: An unsigned, 16-bit integer. It tells you how long, in octets, the ASCII-Origin field is 📏
  • Origin: An OPTIONAL sequence of characters holding the ASCII serialization of an origin ([RFC6454], Section 6.2). It's the origin the sender is saying this connection is, or could be, authoritative for 🔐

The ORIGIN frame doesn't define any flags. But future updates to this spec MAY define flags, so keep an eye out 👀 See Section 2.2 for more 💜

2.2. Processing ORIGIN Frames 🌈

The ORIGIN frame is a non-critical extension to HTTP/2, so endpoints that don't support it can safely ignore it when they get it ✨

When an implementing client receives one, it uses the frame to initialize and manipulate the Origin Set (see Section 2.3). That changes how the client establishes authority for origin servers (see Section 2.4) 🔥

The ORIGIN frame MUST be sent on stream 0. An ORIGIN frame on any other stream is invalid and MUST be ignored. Stream 0 or bust, bestie 🚫

Also, the ORIGIN frame is only valid on connections with the "h2" protocol identifier, or when the protocol's definition specifically nominates it. If it shows up on a connection with the "h2c" protocol identifier, it MUST be ignored 🙈

This spec doesn't define any flags for the ORIGIN frame. Future updates (through IETF consensus) might use them to change its semantics, though 👑 The first four flags (0x1, 0x2, 0x4, and 0x8) are reserved for backwards-incompatible changes. So when any of them are set, clients conforming to this spec MUST ignore the ORIGIN frame containing them, unless they understand the flag's semantics. The remaining flags are reserved for backwards-compatible changes, and they don't affect processing by clients that conform to this spec 🧚

The ORIGIN frame describes a property of the connection, so it's processed hop by hop. An intermediary MUST NOT forward ORIGIN frames. And clients configured to use a proxy MUST ignore any ORIGIN frames they get from it 🛑

Each ASCII-Origin field in the frame's payload MUST be parsed as an ASCII serialization of an origin ([RFC6454], Section 6.2). If parsing fails, the field MUST be ignored 🥲

Heads up: the ORIGIN frame doesn't support wildcard names (for example, "*.example.com") in Origin-Entry. So if you send ORIGIN while a wildcard certificate is in use, you effectively disable every origin that isn't explicitly listed in the ORIGIN frame(s), at least for clients that understand ORIGIN 💀

Hold up, this one's a big deal. Wildcards + ORIGIN = any origin you didn't list explicitly gets switched off for clients that understand the frame. Plan accordingly 🚨

See Appendix A for an illustrative algorithm for processing ORIGIN frames 📖

2.3. The Origin Set 🎀

The set of origins (as per [RFC6454]) that a given connection might be used for is what this spec calls the Origin Set 🫧

By default, the Origin Set for a connection is uninitialized. An uninitialized Origin Set means that clients apply the coalescing rules from Section 9.1.1 of [RFC7540] 🌸

When an ORIGIN frame is first received and successfully processed by a client, the connection's Origin Set gets defined to contain an initial origin. The initial origin is built from three pieces 🧩

  • Scheme: "https"
  • Host: the value sent in Server Name Indication (SNI) ([RFC6066], Section 3), converted to lower case. If SNI isn't present, it's the remote address of the connection (i.e., the server's IP address) 🌐
  • Port: the remote port of the connection (i.e., the server's port) 🔌

The contents of that ORIGIN frame (and any subsequent ones) let the server incrementally add new origins to the Origin Set, as described in Section 2.2 🦋

The 421 (Misdirected Request) response status code, as defined in [RFC7540], Section 9.1.2, also affects the Origin Set 😭 When a response with this status code comes in, implementing clients MUST create the ASCII serialization of the corresponding request's origin (as per [RFC6454], Section 6.2) and remove it from the connection's Origin Set, if it's there 🙅‍♀️

Note: When you send an ORIGIN frame to a connection that was initialized as an alternative service [RFC7838], the initial Origin Set (Section 2.3) will contain an origin with the right scheme and hostname. That's because RFC 7838 says the origin's hostname has to be sent in SNI. But the port might be different from the intended origin's port, since the initial Origin Set is calculated from the actual port in use, and that can differ for the alternative service. In that case, the intended origin needs to be sent explicitly in the ORIGIN frame 🎀

Here's an example so it clicks. A client making requests for https://example.com gets directed to an alternative service at (h2, x.example.net, 8443). If that alternative service sends an ORIGIN frame, the initial origin will be https://example.com:8443. The client won't be able to use the alternative service for requests to https://example.com unless that origin is explicitly included in the ORIGIN frame 🧚 Port drama, iykyk 💅

2.4. Authority, Push, and Coalescing with ORIGIN ✨

okay so bestie, this part is where the magic really happens 🔮 Section 10.1 of [RFC7540] uses BOTH DNS and the presented Transport Layer Security (TLS) certificate to figure out which origin servers a connection is authoritative for, just like HTTP/1.1 does in [RFC7230]. 🦋

Also, Section 9.1.1 of [RFC7540] straight up lets one connection be used for more than one origin server, as long as it's authoritative 🙌 This changes which responses count as authoritative, both for direct responses and for server push (see [RFC7540], Section 8.2.2). And indirectly it changes which requests get sent on a connection, since clients generally only send requests on connections they believe are authoritative for the origin in question. It's giving connection-sharing realness 💅

Once an Origin Set has been initialized for a connection, clients that implement this specification use it to help decide what the connection is authoritative for. Specifically, such clients MUST NOT consider a connection to be authoritative for an origin that isn't in the Origin Set, and they SHOULD use the connection for all requests to origins in the Origin Set that the connection is authoritative for, unless there are operational reasons to open a new connection. Main character rules, no cap 👑

Quick reminder: even with ORIGIN, the server still has to authenticate with a certificate that passes proper checks 🔐 See Section 9.1.1 of [RFC7540] for the full scoop. This includes checking that the host matches a "dNSName" value from the certificate "subjectAltName" field (using the rules defined in [RFC2818]; see also [RFC5280], Section 4.2.1.6). No skipping the vibe check! 🫶

Clients MAY avoid consulting DNS to establish the connection's authority for new requests to origins in the Origin Set; however, those that do so face new risks, as explained in Section 4. Bold choice, but it comes with consequences 💀

Because ORIGIN can change the set of origins a connection is used for over time, a client might have more than one viable connection to the same origin open at any time 🌈 When this happens, clients SHOULD NOT send new requests on any connection whose Origin Set is a proper subset of another connection's Origin Set, and they SHOULD close it once all outstanding requests are satisfied. Tidy up those extra tabs, babe 🧹

The Origin Set is unaffected by any alternative services [RFC7838] advertisements made by the server. Advertising an alternative service does not affect whether a server is authoritative. Two separate vibes, not the same thing at all 🎀

3. IANA Considerations 📋

This specification adds an entry to the "HTTP/2 Frame Type" registry 🧚

  • Frame Type: ORIGIN
  • Code: 0xc
  • Specification: RFC 8336

4. Security Considerations 🚨

Okay, serious moment, bestie 😭 Clients that blindly trust the ORIGIN frame's contents will be vulnerable to a large number of attacks. See Section 2.4 for mitigations. Please don't be that client 🙈

Relaxing the requirement to consult DNS when determining authority for an origin means that an attacker who possesses a valid certificate no longer needs to be on path to redirect traffic to them. Instead of messing with DNS, they only need to convince the user to visit another website in order to coalesce connections to the target onto their existing connection. Scary, right? 👀

As a result, clients that opt not to consult DNS ought to employ some alternative means to establish a high degree of confidence that the certificate is legitimate. For example, clients might skip consulting DNS only if they receive proof of inclusion in a Certificate Transparency log [RFC6962] or if they have a recent Online Certificate Status Protocol (OCSP) response [RFC6960] (possibly using the "status_request" TLS extension [RFC6066]) showing that the certificate was not revoked 🔍✨

The Origin Set's size is unbounded by this specification and thus could be used by attackers to exhaust client resources. To mitigate this risk, clients can monitor their state commitment and close the connection if it is too high. Don't let the set get out of hand, queen 👑🔥

5. References 📚

5.1. Normative References

5.2. Informative References

Appendix A. Non-Normative Processing Algorithm 🧠

The following algorithm illustrates how a client could handle received ORIGIN frames 💖

  1. If the client is configured to use a proxy for the connection, ignore the frame and stop processing.
  2. If the connection is not identified with the "h2" protocol identifier or another protocol that has explicitly opted into this specification, ignore the frame and stop processing.
  3. If the frame occurs upon any stream except stream 0, ignore the frame and stop processing.
  4. If any of the flags 0x1, 0x2, 0x4, or 0x8 are set, ignore the frame and stop processing.
  5. If no previous ORIGIN frame on the connection has reached this step, initialize the Origin Set as per Section 2.3.
  6. For each "Origin-Entry" in the frame payload:
    1. Parse "ASCII-Origin" as an ASCII serialization of an origin ([RFC6454], Section 6.2), and let the result be "parsed_origin". If parsing fails, skip to the next "Origin-Entry".
    2. Add "parsed_origin" to the Origin Set.

Appendix B. Operational Considerations for Servers 🎀

The ORIGIN frame allows a server to indicate which origins a given connection ought to be used for. The set of origins advertised using this mechanism is under control of the server. Servers are not obligated to use it or to advertise all origins that they might be able to answer a request for. Your server, your rules 💅

For example, it can be used to inform the client that the connection is to only be used for the SNI-based origin, by sending an empty ORIGIN frame. Or, a larger number of origins can be indicated by including a payload 🌸

Generally, this information is most useful to send before sending any part of a response that might initiate a new connection, for example "Link" response header fields [RFC8288], or links in the response body. Get the info out early, bestie ⭐

Therefore, the ORIGIN frame ought to be sent as soon as possible on a connection, ideally before any HEADERS or PUSH_PROMISE frames. Timing is everything 🧚

However, if it's desirable to associate a large number of origins with a connection, doing so might introduce end-user-perceived latency, due to their size. As a result, it might be necessary to select a "core" set of origins to send initially, and expand the set of origins the connection is used for with subsequent ORIGIN frames later (e.g., when the connection is idle). Start small, grow later 🦋

That said, senders are encouraged to include as many origins as practical within a single ORIGIN frame. Clients need to make decisions about creating connections on the fly, and if the Origin Set is split across many frames, their behavior might be suboptimal. One big frame > many tiny ones 🫶

Senders take note that, as per Section 4, Step 5, of [RFC6454], the values in an ORIGIN header need to be case-normalized before serialization. Lowercase energy only 🔤

Finally, servers that host alternative services [RFC7838] will need to explicitly advertise their origins when sending ORIGIN, because the default contents of the Origin Set (as per Section 2.3) do not contain any alternative services' origins, even if they have been used previously on the connection. Don't forget your alt-svc crew 🌈

Authors' Addresses 💌

Mark Nottingham

Email: mnot@mnot.net URI: https://www.mnot.net/

Erik Nygren Akamai Technologies

Email: erik+ietf@nygren.org

📦 where this page comes from