Changeset 2054 for draft-ietf-httpbis/latest/p2-semantics.xml

Timestamp:

17/12/12 03:09:16 (10 years ago)

Author:

fielding@…

Message:

improve definition of the From header field; partly addresses #419

File:

• draft-ietf-httpbis/latest/p2-semantics.xml (modified) (2 diffs)

draft-ietf-httpbis/latest/p2-semantics.xml

@@ -2327 +2327 @@
   <x:anchor-alias value="mailbox"/>
 <t>
-   The "From" header field, if given, &SHOULD; contain an Internet
-   e-mail address for the human user who controls the requesting user
-   agent. The address &SHOULD; be machine-usable, as defined by "mailbox"
+   The "From" header field contains an Internet email address for a human
+   user who controls the requesting user agent. The address ought to be
+   machine-usable, as defined by "mailbox"
    in <xref x:sec="3.4" x:fmt="of" target="RFC5322"/>:
 </t>
@@ -2344 +2344 @@
 </artwork></figure>
 <t>
-   This header field &MAY; be used for logging purposes and as a means for
-   identifying the source of invalid or unwanted requests. It &SHOULD-NOT; 
-   be used as an insecure form of access protection. The interpretation
-   of this field is that the request is being performed on behalf of the
-   person given, who accepts responsibility for the method performed. In
-   particular, robot agents &SHOULD; include this header field so that the
+   The From header field is rarely sent by non-robotic user agents.
+   A user agent &SHOULD-NOT; send a From header field without explicit
+   configuration by the user, since that might conflict with the user's
+   privacy interests or their site's security policy.
+</t>
+<t>
+   Robotic user agents &SHOULD; send a valid From header field so that the
    person responsible for running the robot can be contacted if problems
-   occur on the receiving end.
-</t>
-<t>
-   The Internet e-mail address in this field &MAY; be separate from the
-   Internet host which issued the request. For example, when a request
-   is passed through a proxy the original issuer's address &SHOULD; be
-   used.
-</t>
-<t>
-   The client &SHOULD-NOT;  send the From header field without the user's
-   approval, as it might conflict with the user's privacy interests or
-   their site's security policy. It is strongly recommended that the
-   user be able to disable, enable, and modify the value of this field
-   at any time prior to a request.
+   occur on servers, such as if the robot is sending excessive, unwanted,
+   or invalid requests.
+</t>
+<t>
+   Servers &SHOULD-NOT; use the From header field for access control or
+   authentication, since most recipients will assume that the field value is
+   public information.
 </t>
 </section>