diff --git a/deploy.sh b/deploy.sh
index c93509b..0f71d0a 100644
--- a/deploy.sh
+++ b/deploy.sh
@@ -11,7 +11,7 @@ TARGET_BRANCH="gh-pages"
# List of long-lived topic branch names to be published on github.io as a
# subdirectory
-TOPIC_BRANCHES=("split-persistence")
+TOPIC_BRANCHES=("split-persistence" "structured-headers")
containsElement () {
local e match="$1"
diff --git a/index.src.html b/index.src.html
index 5a534fb..b8d60ac 100644
--- a/index.src.html
+++ b/index.src.html
@@ -115,6 +115,9 @@ Reporting API
text: session; url: dfn-session
text: success; url: dfn-success
text: trying; url: dfn-try
+spec: STRUCTURED-HEADERS; urlPrefix: https://httpwg.org/http-extensions/draft-ietf-httpbis-header-structure.html#
+ type: grammar
+ text: sh-dictionary; url: rfc.section.3.2
{
@@ -123,6 +126,12 @@ Reporting API
"href": "https://w3c.github.io/webappsec-secure-contexts/",
"title": "Secure Contexts",
"publisher": "W3C"
+ },
+ "STRUCTURED-HEADERS": {
+ "authors": [ "Mark Nottingham", "Poul-Henning Kamp" ],
+ "href": "https://httpwg.org/http-extensions/draft-ietf-httpbis-header-structure.html",
+ "title": "Structured Headers for HTTP",
+ "publisher": "IETF"
}
}
@@ -167,8 +176,7 @@ Examples
define a set of reporting endpoints named "`endpoint-1`":
- Report-To: { "name": "endpoint-1",
- "url": "https://example.com/reports" }
+ Reporting-Endpoints: endpoint-1="https://example.com/reports"
And the following headers, which direct CSP and HPKP reports to that
@@ -187,10 +195,8 @@ Examples
the following header to define two reporting endpoints:
- Report-To: { "name": "csp-endpoint",
- "url": "https://example.com/csp-reports" },
- { "name": "hpkp-endpoint",
- "url": "https://example.com/hpkp-reports" }
+ Reporting-Endpoints: csp-endpoint="https://example.com/csp-reports",
+ hpkp-endpoint="https://example.com/hpkp-reports"
And the following headers, which direct CSP and HPKP reports to those named
@@ -393,53 +399,41 @@ Document configuration
attribute>endpoints list, which is a list of endpoints, each of
which MUST have a distinct {{endpoint/name}}. (The algorithm in
[[#process-header]] guarantees this by keeping the first entry in a
- `Report-To` header with a particular name.)
+ `Reporting-Endpoints` header with a particular name.)
A server MAY define a set of reporting endpoints for a resource it returns,
- via the `Report-To` HTTP response header field. This mechanism
- is defined in [[#header]], and its processing in [[#process-header]].
+ via the `Reporting-Endpoints` HTTP response header field. This
+ mechanism is defined in [[#header]], and its processing in
+ [[#process-header]].
Each document has an reports
list, which is a list of reports.
-
-
- The value of the `Report-To` HTTP response header field is
- used to construct the reporting configuration for a resource. The header is
- represented by the following ABNF grammar [[!RFC5234]]:
-
-
- Report-To = json-field-value
- ; See Section 2 of [[HTTP-JFV]], and Section 2 of [[RFC8259]]
-
+
- The header's value is interpreted as a JSON-formatted array of objects
- without the outer `[` and `]`, as described in Section 4 of [[HTTP-JFV]].
+ The value of the `Reporting-Endpoints` HTTP response header
+ field is used to construct the reporting configuration for a resource.
- Each object in the array defines an endpoint to which reports may be
- delivered, and will be parsed as defined in [[#process-header]].
+ `Reporting-Endpoints` is a Dictionary Structured Header
+ [[STRUCTURED-HEADERS]]. Each entry in the dictionary defines an
+ endpoint to which reports may be delivered. The entry value MUST be a
+ string.
- The following subsections define the initial set of known members in each
- JSON object the header's value defines. Future versions of this document may
- define additional such members, and user agents MUST ignore unknown members
- when parsing the header.
+ Each endpoint is defined by a String Item, which is interpreted as a
+ URI-reference. If its value is not a valid URI-reference, that endpoint
+ member MUST be ignored.
- The `name` member
+ Moreover, the URL that the member's value represents MUST be potentially
+ trustworthy [[!SECURE-CONTEXTS]]. Non-secure endpoints will be ignored.
- The OPTIONAL `name` member is a string that
- associates a {{endpoint/name}} with the endpoint.
+ No parameters are defined for endpoints, and any parameters which are
+ specified will be silently ignored.
- If present, the member's value MUST be a string. If not present, the
- endpoint will be given the {{endpoint/name}} "`default`".
+ The header is represented by the following ABNF grammar [[!RFC5234]]:
- The `url` member
-
- The REQUIRED `url` member is a string that defines
- the location of the endpoint.
-
- The member's value MUST be a string. Moreover, the URL that the member's value
- represents MUST be potentially trustworthy [[!SECURE-CONTEXTS]].
- Non-secure endpoints will be ignored.
+
+ Reporting-Endpoints = sh-dictionary
+