14.35.2    Range Retrieval Requests ..............................139
   14.36   Referer ..................................................140
   14.37   Retry-After ..............................................141
   14.38   Server ...................................................141
   14.39   TE .......................................................142
   14.40   Trailer ..................................................143
   14.41  Transfer-Encoding..........................................143
   14.42   Upgrade ..................................................144
   14.43   User-Agent ...............................................145
   14.44   Vary .....................................................145
   14.45   Via ......................................................146
   14.46   Warning ..................................................148
   14.47   WWW-Authenticate .........................................150
   15 Security Considerations .......................................150
   15.1      Personal Information....................................151
   15.1.1   Abuse of Server Log Information .........................151
   15.1.2   Transfer of Sensitive Information .......................151
   15.1.3   Encoding Sensitive Information in URI's .................152
   15.1.4   Privacy Issues Connected to Accept Headers ..............152
   15.2  Attacks Based On File and Path Names .......................153
   15.3  DNS Spoofing ...............................................154
   15.4  Location Headers and Spoofing ..............................154
   15.5  Content-Disposition Issues .................................154
   15.6  Authentication Credentials and Idle Clients ................155
   15.7  Proxies and Caching ........................................155
   15.7.1    Denial of Service Attacks on Proxies....................156
   16   Acknowledgments .............................................156
   17   References ..................................................158
   18   Authors' Addresses ..........................................162
   19   Appendices ..................................................164
   19.1  Internet Media Type message/http and application/http ......164
   19.2  Internet Media Type multipart/byteranges ...................165
   19.3  Tolerant Applications ......................................166
   19.4  Differences Between HTTP Entities and RFC 2045 Entities ....167




 
RFC 2616                        HTTP/1.1                       June 1999


   19.4.1   MIME-Version ............................................167
   19.4.2   Conversion to Canonical Form ............................167
   19.4.3   Conversion of Date Formats ..............................168
   19.4.4   Introduction of Content-Encoding ........................168
   19.4.5   No Content-Transfer-Encoding ............................168
   19.4.6   Introduction of Transfer-Encoding .......................169
   19.4.7   MHTML and Line Length Limitations .......................169
   19.5  Additional Features ........................................169
   19.5.1   Content-Disposition .....................................170
   19.6  Compatibility with Previous Versions .......................170
   19.6.1   Changes from HTTP/1.0 ...................................171
   19.6.2   Compatibility with HTTP/1.0 Persistent Connections ......172
   19.6.3   Changes from RFC 2068 ...................................172
   20   Index .......................................................175
   21   Full Copyright Statement ....................................176

1 Introduction

1.1 Purpose

   The Hypertext Transfer Protocol (HTTP) is an application-level
   protocol for distributed, collaborative, hypermedia information
   systems. HTTP has been in use by the World-Wide Web global
   information initiative since 1990. The first version of HTTP,
   referred to as HTTP/0.9, was a simple protocol for raw data transfer
   across the Internet. HTTP/1.0, as defined by RFC 1945 [6], improved
   the protocol by allowing messages to be in the format of MIME-like
   messages, containing metainformation about the data transferred and
   modifiers on the request/response semantics. However, HTTP/1.0 does
   not sufficiently take into consideration the effects of hierarchical
   proxies, caching, the need for persistent connections, or virtual
   hosts. In addition, the proliferation of incompletely-implemented
   applications calling themselves "HTTP/1.0" has necessitated a
   protocol version change in order for two communicating applications
   to determine each other's true capabilities.

   This specification defines the protocol referred to as "HTTP/1.1".
   This protocol includes more stringent requirements than HTTP/1.0 in
   order to ensure reliable implementation of its features.

   Practical information systems require more functionality than simple
   retrieval, including search, front-end update, and annotation. HTTP
   allows an open-ended set of methods and headers that indicate the
   purpose of a request [47]. It builds on the discipline of reference
   provided by the Uniform Resource Identifier (URI) [3], as a location
   (URL) [4] or name (URN) [20], for indicating the resource to which a






 
RFC 2616                        HTTP/1.1                       June 1999


   method is to be applied. Messages are passed in a format similar to
   that used by Internet mail [9] as defined by the Multipurpose