rfc-8297

An HTTP Status Code for Indicating Hints

K. Oku
date2017-12 streamIETF areawit wghttpbis statusPROPOSED STANDARD pages7 canonicalhttps://www.rfc-editor.org/rfc/rfc8297 doi10.17487/RFC8297
This memo introduces an informational HTTP status code that can be used to convey hints that help a client make preparations for processing the final response.

Extracted elements (15)

design-rationale §1

An origin server cannot always generate the full header block of a final response immediately (e.g., when delegating to a distant upstream server or when the status code depends on a database query). The 103 status code allows sending useful header fields like Link preload hints before the final response is determined.

http

design-rationale §1

HTTP/2 server push can accelerate resource delivery but only for resources where the server is authoritative and sends the response regardless of client cache state. Delivering Link header fields via 103 responses costs one extra round trip in the worst case compared to server push but is more flexible and may consume less bandwidth.

http

design-rationale §1

The informational response mechanism allows an origin server to trigger HTTP/2 server push at a caching intermediary, enabling push of resources even when the origin itself cannot push directly to the client.

http

interoperability-note §3

A server might refrain from sending 103 (Early Hints) responses over HTTP/1.1 unless the client is known to handle informational responses correctly, because HTTP/1.1 clients that mishandle informational responses as final responses may treat all subsequent responses on the same connection as continuations of the final response.

http

interoperability-note §3

HTTP/2 clients are less likely to suffer from incorrect framing of 103 responses since handling of response header fields does not affect how the end of the response body is determined.

http

normative-requirement §2 MUST NOT

A client MUST NOT interpret the 103 (Early Hints) response header fields as if they applied to the informational response itself (e.g., as metadata about the 103 response).

http

normative-requirement §2 SHOULD NOT

A client SHOULD NOT interpret the nonexistence of a header field in a 103 (Early Hints) response as a speculation that the header field is unlikely to be part of the final response.

http

normative-requirement §2 MAY

A server MAY emit multiple 103 (Early Hints) responses with additional header fields as new information becomes available while the request is being processed; it does not need to repeat fields already emitted.

http

normative-requirement §2 MAY

A server MAY use a 103 (Early Hints) response to indicate only some of the header fields that are expected to be found in the final response.

http

normative-requirement §2 MUST NOT

Aside from performance optimizations, evaluation of a 103 (Early Hints) response's header fields MUST NOT affect how the final response is processed.

http

protocol-element §2

A client can speculatively evaluate header fields in a 103 (Early Hints) response while waiting for the final response — for example, recognizing a Link header with rel=preload and prefetching the target resource. These header fields are hints only and do not replace header fields on the final response.

http

protocol-element §2

A server might emit more than one 103 (Early Hints) response prior to sending a final response; a client can consider any combination of header fields received in multiple 103 responses when anticipating the final response's header fields.

http

protocol-element §2

HTTP status code 103 (Early Hints) is an informational status code indicating to the client that the server is likely to send a final response with the header fields included in the informational response.

http

registry §4

RFC 8297 registers HTTP status code 103 with description 'Early Hints' in the IANA 'HTTP Status Codes' registry.

http, registry

security-consideration §3

An HTTP/1.1 client that mishandles a 103 informational response as a final response may consider all responses to succeeding requests on the same connection to be part of that final response, which could constitute a cross-origin information disclosure vulnerability when the client multiplexes requests to different origins onto a single persistent connection.

http, security