Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:111224
MIME-Version: 1.0
References: <e827814f-8a4e-4388-bc82-47c244aad978@gmail.com>
 <9d28ade6-1a70-9850-3bc0-64050c0dcbe4@gmail.com> <CAESVnVrajMYWoV9ce6xndsXKszTseP2UJcK_6VN0e_hGDa6SYg@mail.gmail.com>
 <CALKiJKq3X+jV3r9dMFOu_FynpZCjj7j2Bqk7SvAH4mb7uQdfZg@mail.gmail.com>
In-Reply-To: <CALKiJKq3X+jV3r9dMFOu_FynpZCjj7j2Bqk7SvAH4mb7uQdfZg@mail.gmail.com>
Date: Tue, 28 Jul 2020 11:45:30 -0500
Message-ID: <CAESVnVq-vPU64puFmreDstH6iLC--9MiQ4-2xA3Goey+MfZXCA@mail.gmail.com>
To: Rowan Tommins <rowan.collins@gmail.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="00000000000074c66c05ab832b05"
Subject: Re: [PHP-DEV] Re: HTTP/1.1 by default in PHP 8.0
From: pollita@php.net (Sara Golemon)

--00000000000074c66c05ab832b05
Content-Type: text/plain; charset="UTF-8"

On Tue, Jul 28, 2020 at 3:52 AM Rowan Tommins <rowan.collins@gmail.com>
wrote:

> The risk of advertising 1.0 by default is that some software will have been
> programmed to outright refuse that protocol version. I don't know of any
> recent examples, but this bug report from 2007 was for a SOAP endpoint that
> returned 505 Version Not Supported: https://bugs.php.net/bug.php?id=43069
> Notably, Dmitry's patch for that bug made sure the protocol context option
> is honoured by ext/soap, but also specifically defaulted it to HTTP/1.1 as
> of PHP 5.3.
>
> The risk of advertising 1.1 by default is that some software will respond
> with a more complex response, and trigger some bug in our response parsing.
> This was previously the case with detecting "Transfer-Encoding: chunked"
> headers, for instance. By advertising 1.0, we may be benefitting from
> servers "downgrading" their response.
>
> In practice, a large amount of software appears to do neither, and simply
> replies with an HTTP/1.1 response to a HTTP/1.0 request. This is why I talk
> about "advertising" versions - in practice, the code is always acting as an
> HTTP/1.1 client, e.g. sending "Connection: Close", and listening for
> Transfer-Encoding, because it's increasingly rare for a server to actually
> honour the 1.0 spec.
>
> The "servers have a bad habit of ignoring this anyway" argument is
probably true, but it sort of takes the wind out of BOTH of the other two
points. :)

I'm not going to object to merging it, the worst case scenario is that a
few app developers will learn the protocol version option exists and have
to set "1.0" manually.  Even that is a low probability.  Probably better in
the long-term to inch our way forward and advertise a protocol that was
introduced... checks notes... 21 years ago.

-Sara

--00000000000074c66c05ab832b05--