XEP-0363: Incorporate Council feedback

The wording about allowed headers was deemed unclear, so it was
clarified that only allowed headers should be forwarded.

In addition, there were concerns about implementation support for
preserving the relative order of different headers. Considering that
that's unlikely to be a use-case, the wording was changed to not require
that, but only preserving the order of values for the same header.
This commit is contained in:
Jonas Schäfer 2022-01-25 16:52:56 +01:00
parent 2bdac32197
commit cc189abd41
1 changed files with 1 additions and 1 deletions

View File

@ -262,7 +262,7 @@
content-type='image/jpeg' />
</iq>]]></example>
<p>The upload service responds with both a PUT and a GET URL wrapped by a &lt;slot&gt; element. The service SHOULD keep the file name and especially the file ending intact. Using the same hostname for PUT and GET is OPTIONAL. The host MUST provide Transport Layer Security (&rfc5246;). Both HTTPS URLs MUST adhere to &rfc3986;. Non ASCII characters MUST be percent-encoded.</p>
<p>The &lt;put&gt; element MAY also contain a number of &lt;header&gt; elements which correspond to HTTP header fields. Each &lt;header&gt; element MUST have a name-attribute and a content with the value of the header. Only the following header names are allowed: Authorization, Cookie, Expires. These headers MUST be included in the HTTP PUT request. Other header names MUST be ignored by the requesting entity and MUST NOT be included in the HTTP request. The requesting entity MUST strip any newline characters from the header name and value before performing the HTTP request, but MUST keep the same order of headers in the request. Each header name MAY be present zero or more times, and are case insensitive (eXpires is the same as Expires).</p>
<p>The &lt;put&gt; element MAY also contain a number of &lt;header&gt; elements which correspond to HTTP header fields. Each &lt;header&gt; element MUST have a name-attribute and a content with the value of the header. Only the following header names are allowed: Authorization, Cookie, Expires. The allowed headers provided in the response MUST be included in the HTTP PUT request. Other header names MUST be ignored by the requesting entity and MUST NOT be included in the HTTP request. The requesting entity MUST strip any newline characters from the header name and value before performing the HTTP request, but MUST preserve the relative order of multiple values for the same header in the request. Each header name MAY be present zero or more times, and are case insensitive (eXpires is the same as Expires).</p>
<example caption='The upload service responds with a slot'><![CDATA[
<iq from='upload.montague.tld'
id='step_03'