68425 - W3C CUAP: List only supported media types in HTTP Accept header

Status: VERIFIED DUPLICATE of bug 58040

(Core :: Networking: HTTP, defect)

Description

[Gervase Markham [:gerv]]

[ This bug is one of the recommendations in the W3C's "Common User Agent 
Problems" document, URL above. One bug has been filed on each recommendation, 
for deciding whether we do it and, if not, whether we should. ]

3.6 List only supported media types in an HTTP Accept header.

     HTTP/1.1 [RFC2616] defines content negotiation. The client sending out
     a request gives a list of media types that it is willing to accept;
     the server then returns a representation of the object requested in
     one of the specified formats if it is available.

     When entities are embedded in a document (such as images in HTML
     documents), user agents should only send Accept headers for the
     formats they support.

     Example:

     If a user agent can render JPEG, PNG and GIF images, the list of media
     types accepted should be image/jpeg, image/png, image/gif.

     Wrong: User agent agents should not send an HTTP header of Accept: */*
     since the server may support content types that the user agent does
     not. For instance, if a server is configured so that SVG images are
     preferred to PNG images, a user agent that only supports PNG, GIF, and
     JPEG will receive (unsupported) SVG rather than (supported) PNG.

Comment 1

[Matthew T (active 1999-2002)]

On the other hand, sending out a complete list of supported types is a bit of a 
privacy problem.

Comment 2

[Karl Ove Hufthammer]

> On the other hand, sending out a complete list of
> supported types is a bit of a privacy problem.

How?

Comment 3

[Jesse Ruderman]

Does this apply only to images, or does it apply to all supported file types?

Comment 4

[Andrew Clark]

Surely if privacy is an issue you can allow the user to disable the feature.

My personal preference would be to be able to manually edit the accept line, or
at least be able to specify q values on a per mime-type basis. Even without this
feature, sending */* as an accept header is not correct, and as a result a user
could receive an invalid file format when a valid one is available, AND not be
able to do anything about it without any control within the user-agent.

Comment 5

[Gervase Markham [:gerv]]

neeti: I strongly believe this bug should not be futured until there has been a 
discussion on the strategy we are taking.

http://lxr.mozilla.org/seamonkey/source/netwerk/protocol/http/src/nsHTTPRequest.
cpp says:

367     // Send */*. We're no longer chopping MIME-types for acceptance.
368     // MIME based content negotiation has died.
369     // SetHeader(nsHTTPAtoms::Accept, "image/gif,image/x-xbitmap,image/jpeg, 
370     // image/pjpeg, image/png, */*");
371     SetHeader(nsHTTPAtoms::Accept, "*/*");

This comment was checked in by [e-mail] on the 24th of March 2000, 
and the SetHeader("*/*") by [e-mail] on the 23rd of June 2000. What we 
were sending between those times I have no idea. Nothing, I assume.

The checkin comments for neither of these checkins contain a reference to this 
change. Does this change apply to all requests we send, or only those for 
top-level documents? If it is all, we are definitely not in the spirit of the 
RFC, and probably not the letter either...

Gerv

Comment 6

[Darin Fisher]

over to networking:http

Comment 7

[Darin Fisher]

reassigning this to myself.

Comment 8

[Gervase Markham [:gerv]]

No reason why this shouldn't be done soon. It's a trivial fix.

Gerv

Comment 9

[Darin Fisher]

let me try that again...

Comment 10

[Gervase Markham [:gerv]]

Trying the keywords again.

Gerv

Comment 11

[Gervase Markham [:gerv]]

There's a patch for this in bug 58040. These are roughly the same bug, but both 
have useful content, so I'm not closing either.

Gerv

Comment 12

[Darin Fisher]

Gerv, I'm going to mark this as a dupe of bug 58040... so that we can focus
our attention on that bug.

*** This bug has been marked as a duplicate of 58040 ***

Comment 13

[John Unruh]

Verified dupe.