5 ms·

If anyone wants to create a revision to RFC 9110 :) HTTP/1.1 309 Security Advisory Location: https://acme/aaargh-another-advisory

• yencabulator 27d ago
  410 Gone seems sufficient to differentiate from "this never existed".
  • einrealist 26d ago
    But I want to specifically signal a security concern to the requesting party. For example, a artifact proxy (like Artifactory or CodeArtifact) can use this response to warn developers.
    • yencabulator 26d ago
      Structured data in body or HTTP header is plenty for that, no need for a HTTP status. For example, if we were talking about a human-readable /crates/* page, returning 410 Gone with a HTML page explaining the situation to a human, that page could have a JSON-LD snippet explaining the same to a computer.
      • einrealist 20d ago
        A dedicated status code + Location header allows to decouple the way an advisory is presented completely. At that location, there can be any representation, HTML or structured data like JSON-LD. The RFC extension would be small and clean.