{"action":"created","comment":{"url":"https://api.github.com/repos/http2/http2-spec/pulls/comments/23458432","id":23458432,"diff_hunk":"@@ -1227,24 +1227,38 @@ else\n                         might occur for shorter values more quickly or with\n                         higher probability than for longer values.\n                     </t>\n-                    <t>\n-                        Implementations might also choose to protect certain\n-                        header fields that are known to be highly valued, such\n-                        as the Authorization or Cookie header fields, by\n-                        disabling or further limiting compression.\n-                    </t>\n                 </section>\n \n                 <section title=\"Never Indexed Literals\">\n                     <t>\n+                        Implementations can also choose to protect sensitive\n+                        header fields by not compressing them and instead\n+                        encoding their value as literals.\n+                    </t>\n+                    <t>\n                         Refusing to generate an indexed representation for a\n                         header field is only effective if compression is avoided\n                         on all hops.  The never indexed literal (see <xref\n                             target=\"literal.header.never.indexed\"/>) can be used\n                         to signal to intermediaries that a particular value was\n-                        intentionally sent as a literal.  An intermediary MUST\n-                        NOT re-encode a value that uses the never indexed\n-                        literal with a representation that would index it.\n+                        intentionally sent as a literal.\n+                    </t>\n+                    <t>\n+                        An intermediary MUST NOT re-encode a value that uses the\n+                        never indexed literal representation with another\n+                        representation that would index it. If HPACK is used \n+                        for re-encoding, the never indexed literal\n+                        representation MUST be used.\n+                    </t>\n+                    <t>\n+                        The decision on whether a header field is sensitive or\n+                        not is highly dependent on the context. As a generic\n+                        guidance, header fields used for conveying highly valued\n+                        information, such as the Authorization or Cookie header\n+                        fields, can be considered to be on the more sensitive\n+                        side.  In addition, a header field with a short value\n+                        has potentially a smaller entropy and can be more at\n+                        risk.","path":"draft-ietf-httpbis-header-compression.xml","position":44,"original_position":44,"commit_id":"cbea53ebce06a0c57f5fe92b29585709c442fbd3","original_commit_id":"cbea53ebce06a0c57f5fe92b29585709c442fbd3","user":{"login":"martinthomson","id":67641,"avatar_url":"https://avatars.githubusercontent.com/u/67641?v=3","gravatar_id":"","url":"https://api.github.com/users/martinthomson","html_url":"https://github.com/martinthomson","followers_url":"https://api.github.com/users/martinthomson/followers","following_url":"https://api.github.com/users/martinthomson/following{/other_user}","gists_url":"https://api.github.com/users/martinthomson/gists{/gist_id}","starred_url":"https://api.github.com/users/martinthomson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/martinthomson/subscriptions","organizations_url":"https://api.github.com/users/martinthomson/orgs","repos_url":"https://api.github.com/users/martinthomson/repos","events_url":"https://api.github.com/users/martinthomson/events{/privacy}","received_events_url":"https://api.github.com/users/martinthomson/received_events","type":"User","site_admin":false},"body":"How about:\r\n> The choice to use a never indexed literal representation for a header field depends on several factors.  Since HPACK compresses based on the entirety of a value, short or low-entropy values are more readily recovered by an adversary.  Therefore, an encoder might choose to disable compression for values with low entropy.  Encoders might also choose to disable compression for header fields that are considered to be highly valuable or sensitive to recovery, such as the Cookie or Authorization header fields.\r\n\r\n> An encoder might prefer compression for values that have little or no value if they were exposed.  For instance, a User-Agent header field does not commonly vary between requests and is sent to any server.  In that case, confirmation that a particular User-Agent value has been used provides little value.","created_at":"2015-01-23T15:58:50Z","updated_at":"2015-01-23T15:58:50Z","html_url":"https://github.com/http2/http2-spec/pull/704#discussion_r23458432","pull_request_url":"https://api.github.com/repos/http2/http2-spec/pulls/704","_links":{"self":{"href":"https://api.github.com/repos/http2/http2-spec/pulls/comments/23458432"},"html":{"href":"https://github.com/http2/http2-spec/pull/704#discussion_r23458432"},"pull_request":{"href":"https://api.github.com/repos/http2/http2-spec/pulls/704"}}},"pull_request":{"url":"https://api.github.com/repos/http2/http2-spec/pulls/704","id":27930962,"html_url":"https://github.com/http2/http2-spec/pull/704","diff_url":"https://github.com/http2/http2-spec/pull/704.diff","patch_url":"https://github.com/http2/http2-spec/pull/704.patch","issue_url":"https://api.github.com/repos/http2/http2-spec/issues/704","number":704,"state":"open","locked":false,"title":"Expands never indexed literals guidance.","user":{"login":"hruellan","id":3206601,"avatar_url":"https://avatars.githubusercontent.com/u/3206601?v=3","gravatar_id":"","url":"https://api.github.com/users/hruellan","html_url":"https://github.com/hruellan","followers_url":"https://api.github.com/users/hruellan/followers","following_url":"https://api.github.com/users/hruellan/following{/other_user}","gists_url":"https://api.github.com/users/hruellan/gists{/gist_id}","starred_url":"https://api.github.com/users/hruellan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hruellan/subscriptions","organizations_url":"https://api.github.com/users/hruellan/orgs","repos_url":"https://api.github.com/users/hruellan/repos","events_url":"https://api.github.com/users/hruellan/events{/privacy}","received_events_url":"https://api.github.com/users/hruellan/received_events","type":"User","site_admin":false},"body":"Expands section 7.1.3 to describes characteristics of header needing the protection offered by the never indexed literal representation.","created_at":"2015-01-23T15:24:33Z","updated_at":"2015-01-23T15:58:50Z","closed_at":null,"merged_at":null,"merge_commit_sha":"dce085b978a53e01d746cd4f872222bb184308ba","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/http2/http2-spec/pulls/704/commits","review_comments_url":"https://api.github.com/repos/http2/http2-spec/pulls/704/comments","review_comment_url":"https://api.github.com/repos/http2/http2-spec/pulls/comments/{number}","comments_url":"https://api.github.com/repos/http2/http2-spec/issues/704/comments","statuses_url":"https://api.github.com/repos/http2/http2-spec/statuses/cbea53ebce06a0c57f5fe92b29585709c442fbd3","head":{"label":"hruellan:sensitive-header","ref":"sensitive-header","sha":"cbea53ebce06a0c57f5fe92b29585709c442fbd3","user":{"login":"hruellan","id":3206601,"avatar_url":"https://avatars.githubusercontent.com/u/3206601?v=3","gravatar_id":"","url":"https://api.github.com/users/hruellan","html_url":"https://github.com/hruellan","followers_url":"https://api.github.com/users/hruellan/followers","following_url":"https://api.github.com/users/hruellan/following{/other_user}","gists_url":"https://api.github.com/users/hruellan/gists{/gist_id}","starred_url":"https://api.github.com/users/hruellan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hruellan/subscriptions","organizations_url":"https://api.github.com/users/hruellan/orgs","repos_url":"https://api.github.com/users/hruellan/repos","events_url":"https://api.github.com/users/hruellan/events{/privacy}","received_events_url":"https://api.github.com/users/hruellan/received_events","type":"User","site_admin":false},"repo":{"id":8738133,"name":"http2-spec","full_name":"hruellan/http2-spec","owner":{"login":"hruellan","id":3206601,"avatar_url":"https://avatars.githubusercontent.com/u/3206601?v=3","gravatar_id":"","url":"https://api.github.com/users/hruellan","html_url":"https://github.com/hruellan","followers_url":"https://api.github.com/users/hruellan/followers","following_url":"https://api.github.com/users/hruellan/following{/other_user}","gists_url":"https://api.github.com/users/hruellan/gists{/gist_id}","starred_url":"https://api.github.com/users/hruellan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hruellan/subscriptions","organizations_url":"https://api.github.com/users/hruellan/orgs","repos_url":"https://api.github.com/users/hruellan/repos","events_url":"https://api.github.com/users/hruellan/events{/privacy}","received_events_url":"https://api.github.com/users/hruellan/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/hruellan/http2-spec","description":"Working copy of the HTTP/2.0 Specification","fork":true,"url":"https://api.github.com/repos/hruellan/http2-spec","forks_url":"https://api.github.com/repos/hruellan/http2-spec/forks","keys_url":"https://api.github.com/repos/hruellan/http2-spec/keys{/key_id}","collaborators_url":"https://api.github.com/repos/hruellan/http2-spec/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/hruellan/http2-spec/teams","hooks_url":"https://api.github.com/repos/hruellan/http2-spec/hooks","issue_events_url":"https://api.github.com/repos/hruellan/http2-spec/issues/events{/number}","events_url":"https://api.github.com/repos/hruellan/http2-spec/events","assignees_url":"https://api.github.com/repos/hruellan/http2-spec/assignees{/user}","branches_url":"https://api.github.com/repos/hruellan/http2-spec/branches{/branch}","tags_url":"https://api.github.com/repos/hruellan/http2-spec/tags","blobs_url":"https://api.github.com/repos/hruellan/http2-spec/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/hruellan/http2-spec/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/hruellan/http2-spec/git/refs{/sha}","trees_url":"https://api.github.com/repos/hruellan/http2-spec/git/trees{/sha}","statuses_url":"https://api.github.com/repos/hruellan/http2-spec/statuses/{sha}","languages_url":"https://api.github.com/repos/hruellan/http2-spec/languages","stargazers_url":"https://api.github.com/repos/hruellan/http2-spec/stargazers","contributors_url":"https://api.github.com/repos/hruellan/http2-spec/contributors","subscribers_url":"https://api.github.com/repos/hruellan/http2-spec/subscribers","subscription_url":"https://api.github.com/repos/hruellan/http2-spec/subscription","commits_url":"https://api.github.com/repos/hruellan/http2-spec/commits{/sha}","git_commits_url":"https://api.github.com/repos/hruellan/http2-spec/git/commits{/sha}","comments_url":"https://api.github.com/repos/hruellan/http2-spec/comments{/number}","issue_comment_url":"https://api.github.com/repos/hruellan/http2-spec/issues/comments/{number}","contents_url":"https://api.github.com/repos/hruellan/http2-spec/contents/{+path}","compare_url":"https://api.github.com/repos/hruellan/http2-spec/compare/{base}...{head}","merges_url":"https://api.github.com/repos/hruellan/http2-spec/merges","archive_url":"https://api.github.com/repos/hruellan/http2-spec/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/hruellan/http2-spec/downloads","issues_url":"https://api.github.com/repos/hruellan/http2-spec/issues{/number}","pulls_url":"https://api.github.com/repos/hruellan/http2-spec/pulls{/number}","milestones_url":"https://api.github.com/repos/hruellan/http2-spec/milestones{/number}","notifications_url":"https://api.github.com/repos/hruellan/http2-spec/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/hruellan/http2-spec/labels{/name}","releases_url":"https://api.github.com/repos/hruellan/http2-spec/releases{/id}","created_at":"2013-03-12T20:51:24Z","updated_at":"2014-06-16T17:58:32Z","pushed_at":"2015-01-23T15:22:36Z","git_url":"git://github.com/hruellan/http2-spec.git","ssh_url":"git@github.com:hruellan/http2-spec.git","clone_url":"https://github.com/hruellan/http2-spec.git","svn_url":"https://github.com/hruellan/http2-spec","homepage":"http://trac.tools.ietf.org/wg/httpbis/trac/wiki","size":8989,"stargazers_count":0,"watchers_count":0,"language":"XSLT","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"http2:master","ref":"master","sha":"b6e44e306fe93d9f1b535442e3c0618f6b9f13dc","user":{"login":"http2","id":2078837,"avatar_url":"https://avatars.githubusercontent.com/u/2078837?v=3","gravatar_id":"","url":"https://api.github.com/users/http2","html_url":"https://github.com/http2","followers_url":"https://api.github.com/users/http2/followers","following_url":"https://api.github.com/users/http2/following{/other_user}","gists_url":"https://api.github.com/users/http2/gists{/gist_id}","starred_url":"https://api.github.com/users/http2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/http2/subscriptions","organizations_url":"https://api.github.com/users/http2/orgs","repos_url":"https://api.github.com/users/http2/repos","events_url":"https://api.github.com/users/http2/events{/privacy}","received_events_url":"https://api.github.com/users/http2/received_events","type":"Organization","site_admin":false},"repo":{"id":8062859,"name":"http2-spec","full_name":"http2/http2-spec","owner":{"login":"http2","id":2078837,"avatar_url":"https://avatars.githubusercontent.com/u/2078837?v=3","gravatar_id":"","url":"https://api.github.com/users/http2","html_url":"https://github.com/http2","followers_url":"https://api.github.com/users/http2/followers","following_url":"https://api.github.com/users/http2/following{/other_user}","gists_url":"https://api.github.com/users/http2/gists{/gist_id}","starred_url":"https://api.github.com/users/http2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/http2/subscriptions","organizations_url":"https://api.github.com/users/http2/orgs","repos_url":"https://api.github.com/users/http2/repos","events_url":"https://api.github.com/users/http2/events{/privacy}","received_events_url":"https://api.github.com/users/http2/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/http2/http2-spec","description":"Working copy of the HTTP/2 Specification","fork":false,"url":"https://api.github.com/repos/http2/http2-spec","forks_url":"https://api.github.com/repos/http2/http2-spec/forks","keys_url":"https://api.github.com/repos/http2/http2-spec/keys{/key_id}","collaborators_url":"https://api.github.com/repos/http2/http2-spec/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/http2/http2-spec/teams","hooks_url":"https://api.github.com/repos/http2/http2-spec/hooks","issue_events_url":"https://api.github.com/repos/http2/http2-spec/issues/events{/number}","events_url":"https://api.github.com/repos/http2/http2-spec/events","assignees_url":"https://api.github.com/repos/http2/http2-spec/assignees{/user}","branches_url":"https://api.github.com/repos/http2/http2-spec/branches{/branch}","tags_url":"https://api.github.com/repos/http2/http2-spec/tags","blobs_url":"https://api.github.com/repos/http2/http2-spec/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/http2/http2-spec/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/http2/http2-spec/git/refs{/sha}","trees_url":"https://api.github.com/repos/http2/http2-spec/git/trees{/sha}","statuses_url":"https://api.github.com/repos/http2/http2-spec/statuses/{sha}","languages_url":"https://api.github.com/repos/http2/http2-spec/languages","stargazers_url":"https://api.github.com/repos/http2/http2-spec/stargazers","contributors_url":"https://api.github.com/repos/http2/http2-spec/contributors","subscribers_url":"https://api.github.com/repos/http2/http2-spec/subscribers","subscription_url":"https://api.github.com/repos/http2/http2-spec/subscription","commits_url":"https://api.github.com/repos/http2/http2-spec/commits{/sha}","git_commits_url":"https://api.github.com/repos/http2/http2-spec/git/commits{/sha}","comments_url":"https://api.github.com/repos/http2/http2-spec/comments{/number}","issue_comment_url":"https://api.github.com/repos/http2/http2-spec/issues/comments/{number}","contents_url":"https://api.github.com/repos/http2/http2-spec/contents/{+path}","compare_url":"https://api.github.com/repos/http2/http2-spec/compare/{base}...{head}","merges_url":"https://api.github.com/repos/http2/http2-spec/merges","archive_url":"https://api.github.com/repos/http2/http2-spec/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/http2/http2-spec/downloads","issues_url":"https://api.github.com/repos/http2/http2-spec/issues{/number}","pulls_url":"https://api.github.com/repos/http2/http2-spec/pulls{/number}","milestones_url":"https://api.github.com/repos/http2/http2-spec/milestones{/number}","notifications_url":"https://api.github.com/repos/http2/http2-spec/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/http2/http2-spec/labels{/name}","releases_url":"https://api.github.com/repos/http2/http2-spec/releases{/id}","created_at":"2013-02-06T23:48:45Z","updated_at":"2015-01-22T22:14:29Z","pushed_at":"2015-01-23T15:22:11Z","git_url":"git://github.com/http2/http2-spec.git","ssh_url":"git@github.com:http2/http2-spec.git","clone_url":"https://github.com/http2/http2-spec.git","svn_url":"https://github.com/http2/http2-spec","homepage":"http://http2.github.io/","size":26246,"stargazers_count":1024,"watchers_count":1024,"language":"XSLT","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":252,"mirror_url":null,"open_issues_count":32,"forks":252,"open_issues":32,"watchers":1024,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/http2/http2-spec/pulls/704"},"html":{"href":"https://github.com/http2/http2-spec/pull/704"},"issue":{"href":"https://api.github.com/repos/http2/http2-spec/issues/704"},"comments":{"href":"https://api.github.com/repos/http2/http2-spec/issues/704/comments"},"review_comments":{"href":"https://api.github.com/repos/http2/http2-spec/pulls/704/comments"},"review_comment":{"href":"https://api.github.com/repos/http2/http2-spec/pulls/comments/{number}"},"commits":{"href":"https://api.github.com/repos/http2/http2-spec/pulls/704/commits"},"statuses":{"href":"https://api.github.com/repos/http2/http2-spec/statuses/cbea53ebce06a0c57f5fe92b29585709c442fbd3"}}}}