RFC Errata


Errata Search

 
Source of RFC  
Summary Table Full Records

RFC 6797, "HTTP Strict Transport Security (HSTS)", November 2012

Source of RFC: websec (app)

Errata ID: 5204
Status: Rejected
Type: Technical
Publication Format(s) : TEXT

Reported By: Nick Dilßner
Date Reported: 2017-12-13
Rejected by: Francesca Palombini
Date Rejected: 2024-10-29

Section 6.1.2 says:

includeSubDomains

It should say:

include-sub-domains

or

includesubdomains

Notes:

- In Section 6.1 the Strict-Transport-Security is defined as follows:

Strict-Transport-Security = "Strict-Transport-Security" ":" [ directive ] *( ";" [ directive ] )

- valueless Directive "includeSubDomains" is defined as a optional directive
- a directive is definied as followed:

directive = directive-name [ "=" directive-value ]

- so "includeSubDomains" is only a directive-name which is defined as "token"
- according to "[RFC2616], Section 2.2" a token is any octet from 0 - 127 except CTL's (octets 0 - 31 + 127) and separators which NOT exclude '-' (octet 45)


So all Fine? Yes, BUT at [RFC6797], Section 6.1 the "overall reuqirements for directives", Rule 3 defines:

3. Directive names are case-insensitive.

And there is no other specification in Section 6.1.2 or has a IANA policy definition [RFC5226] like it is defined for additionals.



- That means the "directive-name" includeSubDomains is "case-insensitive"!

The "case-sensitive" camelized directive-name is misleading, because of many other definitions with "-", like seen in all examples or in Header Field itself.


- to aware the clear understanding the "directive definition" in section 6.1.2 and ALL occurences needs to be renamend.

the minimum of renaming is "includesubdomains" OR "INCLUDESUBDOMAINS", but this is not readable anymore.
- So it should be renamed like other valuless directives for Example the "schemes-source's" directives at "Content-Security-Policy", which means:

"include-sub-domains"


Best Regards

Nick
--VERIFIER NOTES--
That is true, directive names are case insensitive, which means that, except for possibly misleading the reader, includeSubDomains and includesubdomains are equivalent. Making this change might be considered an editorial fix, however I do not believe this is necessary. Changing the name to "include-sub-domains" can't be done via an erratum, and would need a publishing a consensus document and an update to this rfc.

Report New Errata



Advanced Search