xml-dev - New internet draft on layering protocols on top of HTTP

[Miles Sabin <msabin@cromwellmedia.co.uk>]

This might be of interest to the XML-RPC and SOAP communities,

  On the use of HTTP as a Substrate for Other Protocols
  Keith Moore, University of Tennessee

  http://www.ietf.org/internet-drafts/draft-moore-using-http-00.txt

The conclusions,

> 8. Summary of recommendations regarding reuse of HTTP
>
> 1.   All protocols should provide adequate security.  The 
>      security needs of a particular application will vary 
>      widely depending on the application and its anticipated 
>      use environment.  Merely using HTTP and/or TLS as a 
>      substrate for a protocol does not automatically provide 
>      adequate security for all environments, nor does it 
>      relieve the protocol developers of the need to analyze 
>      security considerations.
>
> 2.   New protocols - including but not limited to those using 
>      HTTP - should not attempt to circumvent users' firewall 
>      policies, particularly by masquerading as existing 
>      protocols.  "Substantially new services" should not to 
>      re-use existing ports.
>
> 3.   New protocols or services should use new URL types.
>
> 4.   Each new protocol specification that uses HTTP as a 
>      substrate should describe the specific way that HTTP is 
>      to be used by that protocol, including how the client 
>      and server interact with proxies.
>
> 5.   New services should define their own error reporting 
>      mechanisms, and use HTTP status codes only for 
>      communicating the state of the HTTP protocol.

Cheers,


Miles

-- 
Miles Sabin                       Cromwell Media
Internet Systems Architect        5/6 Glenthorne Mews
+44 (0)20 8817 4030               London, W6 0LJ, England
msabin@cromwellmedia.com          http://www.cromwellmedia.com/


***************************************************************************
This is xml-dev, the mailing list for XML developers.
To unsubscribe, mailto:majordomo@xml.org&BODY=unsubscribe%20xml-dev
List archives are available at http://xml.org/archives/xml-dev/
***************************************************************************