Date: Sun, 9 Jun 1996 15:14:36 -0700 (PDT)
From: Brian Behlendorf <brian@organic.com>
To: new-httpd@hyperreal.com
cc: new-httpd@hyperreal.com
Subject: Re: expires header merging
In-Reply-To: <199606092019.OAA00258>
Message-ID: <Pine.SGI.3.91.960609151050.7524C-100000@fully.organic.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-new-httpd@apache.org
Precedence: bulk
Reply-To: new-httpd@hyperreal.com

On Sun, 9 Jun 1996, Rob Hartill wrote:
> >  the problem is that any script can add whatever headers it likes, then
> >  when we introduce redirects and modules which add headers too, the
> >  whole thing gets really messy fast.
> >
> >Ummm... well, scripts can do whatever they like, but a response that
> >goes out with more than one expiration date is in *gross* violation of
> >the specs as I read them
> 
> Okay. So do we need to stop Apache from passing on garbage?, it's
> Expires: today, might be something else tomorrow.

If the CGI author wants to send garbage, they're welcome.  If the CGI
author does something legitimate per HTTP and CGI specs (like send only 
one Expires: date) then Apache should not have any behavior which violates 
the specs either.

> Another suggestion is to define a set of HTTP headers that Apache
> must not merge. Instead the most recent duplicated header overwrites
> the last one. 

Yes, this would seem to be wise.  

> Headers can be divided into 3 types:
> 
>  1) those that can be merged (",")  (default for unclassified headers)
>  2) those that should be duplicated (e.g. set-cookie)
>  3) those that should be overwritten (expires)

Yes.  Other possibilities for #3 are Content-type, Location: (?), Date:, 
Last-Modified, etc.  I'm sure our HTTP cop can provide a more complete 
list :)

Any unknown header should fall into #1.

	Brian

--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--
brian@organic.com  |  We're hiring!  http://www.organic.com/Home/Info/Jobs/