From: Corey Bonnell via Datatracker <noreply@ietf.org>
Date: Wed, 22 Jul 2026 10:51:56 -0700
To: <secdir@ietf.org>
Cc: draft-ietf-httpbis-no-vary-search.all@ietf.org, ietf-http-wg@w3.org, last-call@ietf.org
Message-ID: <178474271640.543100.12196993780439829682@dt-datatracker-d4d6ff9d9-fsx7d>

Document: draft-ietf-httpbis-no-vary-search
Title: The No-Vary-Search HTTP Caching Extension
Reviewer: Corey Bonnell
Review result: Has Issues

The Security Considerations say "The main risk to be aware of is the impact of
mismatched URLs", but nowhere in this document (or in any of the normative
references) is a "mismatched URL" defined. I think this section needs to
elaborate on what this is so the guidance can be understood.

However, the most significant issue is that the Security Considerations is
seemingly written from the standpoint of a web browser. Given that non-browser
technologies also may implement this specification, I would expect this section
to contain guidance for other types of caches, especially shared caches.

A few other comments outside the Security Considerations:
1. Since Section 7 of this document replaces text in Section 4 of RFC 9111, I
would expect that this document updates RFC 9111. 2. Section 5.3 scopes the
algorithm to ASCII inputs ("To parse a key given an ASCII string keyString:"),
but the examples in 5.3.1 all contain non-ASCII code points.

Received on Wednesday, 22 July 2026 17:52:22 UTC