[Docs] [txt|pdf] [Tracker] [Email] [Diff1] [Diff2] [Nits]

Versions: 00 01 02 03 04 05

Network Working Group                                      S. Harhalakis
Internet-Draft                                       TEI of Thessaloniki
Intended status: Experimental                              July 27, 2009
Expires: January 28, 2010


                      Timezone Information in HTTP
                    draft-sharhalakis-httptz-05.txt

Status of this Memo

   This Internet-Draft is submitted to IETF in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF), its areas, and its working groups.  Note that
   other groups may also distribute working documents as Internet-
   Drafts.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   The list of current Internet-Drafts can be accessed at
   http://www.ietf.org/ietf/1id-abstracts.txt.

   The list of Internet-Draft Shadow Directories can be accessed at
   http://www.ietf.org/shadow.html.

   This Internet-Draft will expire on January 28, 2010.

Copyright Notice

   Copyright (c) 2009 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents in effect on the date of
   publication of this document (http://trustee.ietf.org/license-info).
   Please review these documents carefully, as they describe your rights
   and restrictions with respect to this document.









Harhalakis              Expires January 28, 2010                [Page 1]

Internet-Draft        Timezone Information in HTTP             July 2009


Abstract

   This document defines a HTTP header for clients to provide timezone
   information to web servers.  An ABNF description of the corresponding
   header is provided.














































Harhalakis              Expires January 28, 2010                [Page 2]

Internet-Draft        Timezone Information in HTTP             July 2009


Discussion

   Discussion about this document takes place in http-wg mailing list
   (ietf-http-wg@w3.org).  Please CC v13@v13.gr too.


Table of Contents

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  4
     1.1.  Purpose  . . . . . . . . . . . . . . . . . . . . . . . . .  4
     1.2.  Requirements . . . . . . . . . . . . . . . . . . . . . . .  4
     1.3.  Terminology  . . . . . . . . . . . . . . . . . . . . . . .  4
     1.4.  Considerations . . . . . . . . . . . . . . . . . . . . . .  5
   2.  Definition . . . . . . . . . . . . . . . . . . . . . . . . . .  7
     2.1.  Client support . . . . . . . . . . . . . . . . . . . . . .  7
     2.2.  Server support . . . . . . . . . . . . . . . . . . . . . .  8
     2.3.  Proxy considerations . . . . . . . . . . . . . . . . . . .  8
   3.  Security Considerations  . . . . . . . . . . . . . . . . . . .  9
     3.1.  Client side  . . . . . . . . . . . . . . . . . . . . . . .  9
     3.2.  Server side  . . . . . . . . . . . . . . . . . . . . . . .  9
   4.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 10
   5.  Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 11
   6.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 12
     6.1.  Normative  . . . . . . . . . . . . . . . . . . . . . . . . 12
     6.2.  Informative  . . . . . . . . . . . . . . . . . . . . . . . 12
   Appendix A.  Examples  . . . . . . . . . . . . . . . . . . . . . . 13
   Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 14
























Harhalakis              Expires January 28, 2010                [Page 3]

Internet-Draft        Timezone Information in HTTP             July 2009


1.  Introduction

1.1.  Purpose

   Many web based applications could benefit from knowing the timezone
   of their visiting clients.  Most of the dynamic content provider
   applications depend on user accounts to display time and date in the
   client's native timezone.  This is a common problem and the current
   solution is not always possible or adequate for reasons inlcuding:

   o  There may be no user accounts involved.  News sites or RSS feeds
      for example don't require users to have accounts.

   o  People may travel across timezone boundaries.  Currently they need
      to update their web accounts to reflect their actual timezone
      information.

   Furthermore, this is also the case for all HTTP-like or HTTP based
   protocols that make use of timestamps.

   This document addresses this need by describing a header to be used
   by HTTP [RFC2616] so that interested clients may provide their
   current timezone information to web servers and thus to web based
   applications.

   At the time of this writting GPS-enabled Internet access devices like
   mobile phones are being deployed.  In the near future, those devices
   may be able to use GPS information and properly adjust their timezone
   information.  This could be of great help for people that travel
   accross timezones.

1.2.  Requirements

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [RFC2119].

   An implementation is not compliant if it fails to satisfy one or more
   of the MUST or REQUIRED level requirements.  An implementation that
   satisfies all the MUST or REQUIRED level and all the SHOULD level
   requirements is said to be "unconditionally compliant"; one that
   satisfies all the MUST level requirements but not all the SHOULD
   level requirements is said to be "conditionally compliant".

1.3.  Terminology

   This document uses the following terms:




Harhalakis              Expires January 28, 2010                [Page 4]

Internet-Draft        Timezone Information in HTTP             July 2009


   HTTP client
      Every client of the HTTP protocol.  Commonly referred to as a web
      browser.

   Timezone string
      A timezone string as described in this document.

   HTTP header
      An HTTP header as described in [RFC2616].

   The HTTP header specification of this document is presented in the
   augmented Backus-Naur Form that is described in [RFC2616].

1.4.  Considerations

   Because of the variety of systems on the Internet and the non-
   technical nature of timezone, there is no simple method for a client
   to provide timezone information to HTTP servers.  During the writing
   of this document the following were considered:

   o  Simplicity is a must.  The specification needs to be as simple as
      possible or allow for partial handling in a simple manter.

   o  There is a variety of timezone styles.  Some countries don't
      experience Daylight Saving Time (DST).  Other countries have very
      unstable DST.

   o  Politics affect DST.  This makes it a moving target.

   o  DST settings may change from year to year.  For example, in 2007
      the DST start and end time in some states in USA were changed.

   o  Complete past and future timezone information cannot be described
      using a simple string.

   o  End user systems may have an invalid timezone configured.

   o  There are systems without timezone information.

   o  Not all systems have a time source.

   This document tries to provide adequate data for applications that
   can take advantage of the Timezone information to fulfill their
   needs.  There are different levels of requirements that applications
   may have or HTTP clients may be able to satisfy.  Thus this document
   introduces a way for HTTP clients to provide:





Harhalakis              Expires January 28, 2010                [Page 5]

Internet-Draft        Timezone Information in HTTP             July 2009


   o  The current client time.

   o  The current time offset.

   o  The current year's timezone information.

   o  Complete timezone information.

   depending on their abilities.

   Simple server side applications may just use the current time offset
   and hope that it is correctly set.  More advanced applications (like
   calendars) need to know when a DST change will occur to correctly
   represent future or past times.  Even more advanced applications may
   need to know the exact client timezone which can only be described
   using a reference to a timezone database entry.  Finally,
   applications may choose to use the client's current time as reference
   time and optionally ignore client timezone information.

   An issue that was discussed when proposing this header was the need
   of its existence.  The alternative approach is to leave the time and
   timezone information handling to server side applications which can
   use geo-ip, user accounts, etc.  This is not an option because:

   o  Geo-ip is not suitable for HTTPS clients behind a proxy.

   o  User accounts are not efficient for public pages like news sites,
      blogs, forums, search engines, etc.

   HTTP-based protocols may also take advantage of this feature.

   Another consideration is the validity of client-side time or timezone
   information.  It seems that proper timezone information is gradually
   being adopted as common behavior.  Even though this document attempts
   to help clients without timezone information and provide ultimate
   flexibility to server side applications, the validity of the timezone
   information is considered an existing precondition.  This is in
   accordance with paragraph 4.4 of [RFC3339] "Unqualified Local Time"
   which considers systems with invalid timezone information as
   inappropriate for Internet communications.











Harhalakis              Expires January 28, 2010                [Page 6]

Internet-Draft        Timezone Information in HTTP             July 2009


2.  Definition

2.1.  Client support

   HTTP clients MAY provide local timezone information to visiting web
   sites.  This information is sent using the client-timezone HTTP
   header:


      client-timezone  =  "Timezone" ":" tzdescr

      tzdescr          =  rfctime [ ";" posixtz [ ";" tznames ] ]

      rfctime          =  <local time>

      posixtz          =  <a POSIX 1003.1 timezone string>

      tznames          =  tzname *( "," tzname )

      tzname           =  <a timezone string from a timezone database>

   Where:

   rfctime    A local time string as specified in [RFC3339].  It
              includes the current time offset.

   posixtz    A POSIX 1003.1 timezone string as specified in [POSIXTZ].

   tzname     A timezone name.  Many systems use a timezone name from a
              timezone database.  This is one such string.  More than
              one such strings may be provided.  All of them MUST
              identify the same timezone.

   HTTP clients SHOULD provide all three parts of the header unless they
   aren't able to do so or they are configured not to send timezone
   information.

   If a client does not provide a part of the header and there is
   another part following that is provided, the client MUST use the
   empty string for the part that is not provided.

   Clients that don't have a clock source MUST use zeroes for all digits
   of the datetime string except from the offset.  "Z" MUST by used when
   the offset is also unavailable.

   When multiple references to timezone databases are specified the
   server-side SHOULD perform a left-to-right search.  This means that
   the server-side application first searches its database for the first



Harhalakis              Expires January 28, 2010                [Page 7]

Internet-Draft        Timezone Information in HTTP             July 2009


   provided timezone.  If the search fails the search continues for the
   second timezone, etc.  The search ends when a matching entry is found
   or there is no provided timezone database reference to search for.
   The client side MUST assume that the server side uses this search
   method.

2.2.  Server support

   Compliant servers MAY validate the format of the provided
   information.  Timezone strings that are not in a valid format MAY not
   be accepted.  Validation checks MUST NOT be performed on the content
   of the Timezone string by servers.  Only the format of the string may
   be checked.  This way outdated servers will not filter out proper
   information.

2.3.  Proxy considerations

   HTTP proxy servers MUST NOT alter this information.  HTTP proxy
   servers MUST follow the same validation policy that was specified for
   servers.

   Server side scripts that produce customized results based on the
   timezone information MUST return an appropriate "Vary" header as
   specified in paragraph 14.44 of [RFC2616].



























Harhalakis              Expires January 28, 2010                [Page 8]

Internet-Draft        Timezone Information in HTTP             July 2009


3.  Security Considerations

3.1.  Client side

   Timezone information may consist personal information regarding the
   location of a person.  HTTP clients MUST NOT provide this information
   without letting the user prevent it.  Clients must either ask users
   or provide an option to enable/disable this feature.  The later is
   RECOMMENDED.

   In most cases Timezone information will not disclose more personal
   information than an IP address.  HTTP clients MAY default in enabling
   this to improve user experience.  It is also possible that client
   behavior regarding timezone information disclosure be controlled by
   implicit privacy settings.

3.2.  Server side

   Web based applications MUST treat this information as user input that
   may be invalid or malicious.































Harhalakis              Expires January 28, 2010                [Page 9]

Internet-Draft        Timezone Information in HTTP             July 2009


4.  IANA Considerations

   This specification requires registration of a Message Header Field
   for HTTP [RFC3864].

   Header field:  Timezone

   Applicable protocol:  HTTP

   Status:  Experimental

   Author/change controller:
       IETF (iesg@ietf.org)
       Internet Engineering Task Force

   Specification document:
       [ this document ]


































Harhalakis              Expires January 28, 2010               [Page 10]

Internet-Draft        Timezone Information in HTTP             July 2009


5.  Acknowledgements

   Timezone information in HTTP was also proposed by David Robinson in
   an email at HTTP Working Group back in 1995 but the replies he got
   were negative.  It was believed that timezone information should be
   handled by CGI scripts and not by the Hypertext Transfer Protocol.
   The discussion can be found at http-wg mailing list archives: <http:/
   /www.hpl.hp.com/personal/ange/archives/archives-95/http-wg-archive/
   0521.html>.

   This document was properly formed thanks to the remarks of Julian
   Reschke.







































Harhalakis              Expires January 28, 2010               [Page 11]

Internet-Draft        Timezone Information in HTTP             July 2009


6.  References

6.1.  Normative

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

   [RFC2616]  Fielding, R., Gettys, J., Mogul, J., Frystyk, H.,
              Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext
              Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999.

   [RFC3339]  Klyne, G., Ed. and C. Newman, "Date and Time on the
              Internet: Timestamps", RFC 3339, July 2002.

   [RFC3864]  Klyne, G., Nottingham, M., and J. Mogul, "Registration
              Procedures for Message Header Fields", BCP 90, RFC 3864,
              September 2004.

   [POSIXTZ]  IEEE, The Open Group, "IEEE Std 1003.1", 2004.

6.2.  Informative

   [I-D.rfc-editor-rfc2223bis]
              Reynolds, J. and R. Braden, "Instructions to Request for
              Comments (RFC) Authors", draft-rfc-editor-rfc2223bis-08
              (work in progress), July 2004.

























Harhalakis              Expires January 28, 2010               [Page 12]

Internet-Draft        Timezone Information in HTTP             July 2009


Appendix A.  Examples

   A complete timezone information header using the Olson timezone
   database:

   Assuming that current time is 12:00, Jul 30, 1977.  Time offset is +2
   hours.  The full timezone string in [POSIXTZ] format is
   EET2EEST3,M3.2.0/02:00,M11.1.0/02:00.  The timezone database
   identifier string is Europe/Athens:

   Timezone: 1977-07-30T12:00+0200;
       EET2EEST3,M3.2.0/02:00,M11.1.0/02:00;
       Europe/Athens

   A partial one:

   GMT/UTC timezone is noted as Z(ulu).

   Timezone: 2007-06-12T23:48Z

   A header from a clock-less client:

   Timezone: 0000-00-00T00:00+0200;
       EET2EEST3,M3.2.0/02:00,M11.1.0/02:00;
       Europe/Athens

   A header with multiple database references (Olson and Microsoft
   Windows timezone databases):

   Timezone: 1977-07-30T12:00+0200;
       EET2EEST3,M3.2.0/02:00,M11.1.0/02:00;
       Europe/Athens;(GMT+02:00) Athens, Istanbul, Minsk

   A header from a clock-less client without current offset information:

   Timezone: 0000-00-00T00:00Z

   A header with a missing part:

   Timezone: 1977-07-30T12:00+0200;;Europe/Athens











Harhalakis              Expires January 28, 2010               [Page 13]

Internet-Draft        Timezone Information in HTTP             July 2009


Author's Address

   Stefanos Harhalakis
   Technological Educational Institute of Thessaloniki
   Department of Information Technology
   Thessaloniki, Greece
   GR

   Email: v13@v13.gr, v13@it.teithe.gr










































Harhalakis              Expires January 28, 2010               [Page 14]


Html markup produced by rfcmarkup 1.109, available from https://tools.ietf.org/tools/rfcmarkup/