[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

POST vs GET


Peter Gutmann <> wrote on Friday, February 20, 2004 5:45 PM:


http://www.cs.auckland.ac.nz/~pgut001/cryptlib/ should do it, it's
open-source and does both client and server.
(There is one deviation from the SCEP spec, it uses a standard HTTP
engine  that can't do the (nonstandard) non-idempotent PUT required
by SCEP, so  you'll have to use HTTP POST rather than PUT to submit
requests.


That would prevent it from working with any existing client or CA server.
It is actually a GET, not a PUT.   What standard does it violate besides the
obvious esthetic ones?

I've grumbled about this before, this really should be fixed in the spec

We are working on a new rev to the SCEP specification, so this might be a good time
to talk about it.

We can't make the big ugly GETs go away, because that is what all of the installed base
uses, and what all of the current CAs expect.

If we change the spec to allow POST, how would a client tell if it is talking to a CA
that supports it?

Should there be a GET that gets the SCEP version number and/or capabilities?

since it breaks HTTP proxies and caches).

Proxies and caches should be able to handle the fact that web pages don't stay the same forever.

Andy Nourse
Cisco