Closed Bug 68425 Opened 24 years ago Closed 24 years ago

W3C CUAP: List only supported media types in HTTP Accept header

Categories

(Core :: Networking: HTTP, defect)

defect
Not set
normal

Tracking

()

VERIFIED DUPLICATE of bug 58040
Future

People

(Reporter: gerv, Assigned: darin.moz)

References

()

Details

[ This bug is one of the recommendations in the W3C's "Common User Agent Problems" document, URL above. One bug has been filed on each recommendation, for deciding whether we do it and, if not, whether we should. ] 3.6 List only supported media types in an HTTP Accept header. HTTP/1.1 [RFC2616] defines content negotiation. The client sending out a request gives a list of media types that it is willing to accept; the server then returns a representation of the object requested in one of the specified formats if it is available. When entities are embedded in a document (such as images in HTML documents), user agents should only send Accept headers for the formats they support. Example: If a user agent can render JPEG, PNG and GIF images, the list of media types accepted should be image/jpeg, image/png, image/gif. Wrong: User agent agents should not send an HTTP header of Accept: */* since the server may support content types that the user agent does not. For instance, if a server is configured so that SVG images are preferred to PNG images, a user agent that only supports PNG, GIF, and JPEG will receive (unsupported) SVG rather than (supported) PNG.
Blocks: 68427
On the other hand, sending out a complete list of supported types is a bit of a privacy problem.
Hardware: PC → All
> On the other hand, sending out a complete list of > supported types is a bit of a privacy problem. How?
Does this apply only to images, or does it apply to all supported file types?
Surely if privacy is an issue you can allow the user to disable the feature. My personal preference would be to be able to manually edit the accept line, or at least be able to specify q values on a per mime-type basis. Even without this feature, sending */* as an accept header is not correct, and as a result a user could receive an invalid file format when a valid one is available, AND not be able to do anything about it without any control within the user-agent.
Target Milestone: --- → Future
neeti: I strongly believe this bug should not be futured until there has been a discussion on the strategy we are taking. http://lxr.mozilla.org/seamonkey/source/netwerk/protocol/http/src/nsHTTPRequest. cpp says: 367 // Send */*. We're no longer chopping MIME-types for acceptance. 368 // MIME based content negotiation has died. 369 // SetHeader(nsHTTPAtoms::Accept, "image/gif,image/x-xbitmap,image/jpeg, 370 // image/pjpeg, image/png, */*"); 371 SetHeader(nsHTTPAtoms::Accept, "*/*"); This comment was checked in by ruslan@netscape.com on the 24th of March 2000, and the SetHeader("*/*") by gagan@netscape.com on the 23rd of June 2000. What we were sending between those times I have no idea. Nothing, I assume. The checkin comments for neither of these checkins contain a reference to this change. Does this change apply to all requests we send, or only those for top-level documents? If it is all, we are definitely not in the spirit of the RFC, and probably not the letter either... Gerv
over to networking:http
Component: Networking → Networking: HTTP
reassigning this to myself.
Component: Networking: HTTP → Networking
No reason why this shouldn't be done soon. It's a trivial fix. Gerv
let me try that again...
Assignee: neeti → darin
Component: Networking → Networking: HTTP
Trying the keywords again. Gerv
There's a patch for this in bug 58040. These are roughly the same bug, but both have useful content, so I'm not closing either. Gerv
Blocks: 61682
Gerv, I'm going to mark this as a dupe of bug 58040... so that we can focus our attention on that bug. *** This bug has been marked as a duplicate of 58040 ***
Status: NEW → RESOLVED
Closed: 24 years ago
Resolution: --- → DUPLICATE
Verified dupe.
Status: RESOLVED → VERIFIED
QA Contact: tever → junruh
You need to log in before you can comment on or make changes to this bug.