https://bz.apache.org/bugzilla/show_bug.cgi?id=60362

--- Comment #60 from Mark Thomas <ma...@apache.org> ---
To provide a some context / background.

7.0.x, 8.0.x always send the reason phrase
8.5.x does not send the reason phrase by default but can be configured to do so
9.0.x does not send the reason phrase and can not be configured to do so

Based on the typical lifetime of Tomcat release branches (roughly a decade or a
little over and seemingly getting longer) there will be a Tomcat version
(8.5.x) that can provide a reason phrase for at least 6 years, probably longer.

There were multiple reasons for dropping the reason phrase in 9.0.x:
- RFC 7230 states that clients SHOULD ignore it and therefore why bother
sending it
- HTTP/2 doesn't support the reason phrase at all
- It has always (going back to at least RFC 2616) been optional - i.e. spec
compliant clients should accept a zero length reason phrase
- It does save a few bytes although this will be in the noise for most users
- It allowed a little complexity to be removed (the possibility of custom
reason phrases and ensuring that they were safe) from the processing of every
request. This will be in the noise for most users.

Generally, the view was (and is) that the change is beneficial for the majority
of spec compliant clients and for those clients that can't handle a missing
reason phrase there is a viable option (8.5.x) for a relatively (in IT terms)
long period.

On a related point, it is worth noting that, as a result of vulnerabilities
such as CVE-2016-6816, Tomcat, and HTTP servers generally, are becoming more
strict in what will be accepted. Clients that do not follow the relevant
specifications and cannot be easily fixed when problems are identified are
likely to become increasingly problematic.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

Reply via email to