Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SVCB-Used HTTP header #163

Closed
wants to merge 1 commit into from
Closed

SVCB-Used HTTP header #163

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions draft-ietf-dnsop-svcb-httpssvc.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -987,6 +987,17 @@ record, groups of clients will necessarily receive the same
SvcFieldValue. Therefore, HTTPSSVC is not suitable for uses that
require single-client granularity.

## SVCB-Used header

When making HTTPS requests to a server discovered through
HTTPSSVC records, clients SHOULD send a "SVCB-Used" HTTP
request header. This is intended to help server operators
with operational tasks and diagnostics. The value of the
"SVCB-Used" header SHOULD be the last SvcDomainName.
Clients concerned about privacy leakage from the full SvcDomainName
MAY instead send a value derifed from either the last SvcPriority
or the minimum of 1 and the SvcPriority.

## Interaction with Alt-Svc

Clients that do not implement support for Encrypted ClientHello MAY
Expand Down Expand Up @@ -1207,6 +1218,18 @@ network, or flushed on network changes, to prevent a local adversary in one
network from implanting a forged DNS record that allows them to
track users or hinder their connections after they leave that network.

The SVCB-Used header allows information to be conveyed from
the DNS lookup and into an HTTPS request. This presents some
opportunities for linkability, so privacy-sensitive clients may
wish to just send a SVCB-Used value of SvcPriority, or even "0"/"1".
DNS operators have other ways to encode similar information (such
as in IPv6 addresses or ECH configuration parameters sent in
the TLS handshake) which leak this information in cleartext to
passive observers, whereas SVCB-Used is strictly better in that it
allows server operators to understand SVCB usage without exposing this
information to third-parties.


# IANA Considerations

## New registry for Service Parameters {#svcparamregistry}
Expand Down