A Reputation Query Protocol

There is no automated discovery protocol for finding reputation services; these are subscription services negotiated between operators out-of-band. This avoids complexity while reflecting the controlled, trust-based nature of reputation relationships.

security

Using URI templates (RFC 6570) rather than a fixed query URL format allows reputation service providers to extend the query parameter set and gives servers flexibility in their URI structure, while keeping the base parameters (application, service, subject, assertion) standardized.

http

Reputation applications can extend the set of optional or required query parameters as part of their IANA registration. Private extensions defined by specific service providers are not registered with IANA and represent bilateral arrangements between client and server.

http, registry

A server receiving a query about an application it does not recognize or explicitly support MUST return a 404 error code.

http, security

A server SHOULD include support for providing reputation service over HTTP and publish templates indicating that support, as a baseline for interoperability with arbitrary clients.

http

A template file containing more than one template MUST separate each template with a carriage return (ASCII 0x0D) and newline (ASCII 0x0A) character pair.

http

If an Expires field is present in the template response, the client SHOULD NOT send another query to the same server before the indicated timestamp. If no Expires field is present, the client SHOULD wait at least one day before re-querying.

http

If the server includes an HTTP Expires header in its response, that timestamp MUST align with the 'expires' field within the reputon payload. Misalignment can cause a state where the payload has expired but the HTTP reply has not, preventing the client from fetching a fresh answer.

http, json

Service providers crafting URI templates MUST ensure that expansion of optional variables (including empty-string substitution) still produces a syntactically and semantically valid, unambiguous URI.

http

The server's response to the template retrieval request MUST use the text/plain media type and SHOULD include an Expires header field indicating how long clients should consider the template valid.

http

The 'service' variable in the query URI template MUST be the same host to which the template retrieval query was issued, preventing cross-host template redirection.

http, security

Clients MUST provide three variables when expanding a query template: 'application' (IANA-registered application name, MIME token syntax), 'service' (the hostname or IP of the reputation server), and 'subject' (the entity being evaluated, MIME value syntax).

http

Reputation query responses are delivered using the 'application/reputon+json' media type as defined in RFC 7071. The response body is a JSON-encoded reputon structure.

http, json

The client attempts each expanded template in file order, using the first URI scheme it can connect to. This allows a server to offer multiple transport options (e.g., HTTP and HTTPS) in priority order.

http

The optional 'assertion' variable names the specific reputation assertion requested. If absent, the client requests all available assertion information. A specific application definition may declare this parameter mandatory.

http

The reputation query protocol is a two-stage process: (1) a client retrieves a URI template from the reputation server at a well-known location, and (2) the client expands the template and issues an HTTP GET to obtain reputation data.

http, json, security

The URI template is retrieved by requesting the well-known URI 'repute-template' from the reputation service host using HTTP. The client then expands template variables to form the actual query URI.

http

This document registers the 'repute-template' well-known URI in the IANA 'Well-Known URI' registry (RFC 5785). The URI suffix is 'repute-template', the change controller is IETF, and the specification document is RFC 7072.

registry, http

Authentication between reputation client and server is explicitly outside the scope of this specification and must be provided through separate transport-based or object-based mechanisms.

security, http

The template retrieval mechanism uses plain HTTP, which is not secure without extensions. Confidentiality of reputation queries and responses can be achieved by using HTTP over TLS (HTTPS).

security, http, tls

Validity and appropriate use of reputation information are security concerns beyond the scope of this specification; implementers should consult RFC 7070 and the operational considerations document for general guidance.

security