RFC 6585

RFC 6585
Title	RFC 6585
Authors	Roy T. Fielding, Julian Reschke
Series	Request for Comments
Number	6585
Pubdate	April 2012
Status	Standards Track
Pages	10

RFC 6585 RFC 6585 is a standards-track memorandum that specifies additional HTTP status codes to extend the semantics of the Hypertext Transfer Protocol. The document enumerates five status codes to address operational, caching, and rate-limiting needs for web infrastructure, situating itself in the lineage of Internet engineering documents alongside other Request for Comments publications and working group outputs from the Internet Engineering Task Force.

Introduction

RFC 6585 supplements earlier specifications such as Hypertext Transfer Protocol -- HTTP/1.1, the work of authors associated with W3C and IETF HTTPbis efforts, and interacts with protocols described in documents produced by entities like Internet Assigned Numbers Authority and Internet Society. The memo formalizes status responses intended for intermediaries and origin servers used by implementations from vendors including Mozilla Corporation, Google, Microsoft, Apple Inc., and commercial content delivery networks such as Akamai Technologies and Cloudflare.

Background and Purpose

The Background and Purpose section explains motivations rooted in operational experiences reported by operators at organizations like Facebook, Twitter, Amazon (company), and academic providers such as MIT and Stanford University. RFC 6585 responds to practical needs observed in deployments involving load balancers from F5 Networks, reverse proxies modeled after NGINX, and cache systems like Varnish and Squid (software). The document aligns with measurement and discussion forums including the IETF HTTP Working Group, presentations at USENIX, and incident reports similar to outages documented in press outlets and postmortems from companies such as Dropbox.

HTTP Status Codes Added

RFC 6585 defines five explicit HTTP status codes to extend the registry managed by IANA for HTTP status codes. These are missing from older specifications like earlier drafts of RFC 2616 and later formalizations in RFC 7231 and related documents from the IETF HTTPbis effort. The codes address situations encountered by services at scale from providers like LinkedIn and research platforms at Carnegie Mellon University and University of California, Berkeley.

The newly specified responses are intended to be used by origin servers and intermediaries such as proxies operated by OpenResty users and CDN configurations by Fastly, complementing behaviors expected by clients implemented by projects like libcurl, Node.js, Apache HTTP Server, and Lighttpd.

Rationale and Design Considerations

Design rationale cites trade-offs familiar to architects at Netflix, data center operators from Equinix, and infrastructure teams using orchestration from Kubernetes and Docker (software). Considerations include interoperability with caching rules described by authors associated with Tim Berners-Lee and URI handling practices discussed at IETF meetings. The choices reflect constraints discussed in standards produced by bodies such as the IEEE and interoperability testing performed by open-source communities including GitHub contributors.

The memo evaluates collision risks in the IANA status code registry, referencing precedents like the allocation processes overseen by IANA and coordination practices used by standards bodies such as W3C and ETSI. It balances explicit machine-readable signaling—useful to teams at Palantir Technologies and Salesforce—against the desire to avoid overloading status code meanings, a concern raised in technical forums involving Red Hat and Canonical (company) engineers.

Implementation and Adoption

Implementation notes summarize adoption across server software and intermediary platforms, noting uptake in Apache HTTP Server modules, configurations in NGINX and HAProxy, and behavior in client libraries such as Requests (software) and OkHttp. Major cloud providers like Amazon Web Services, Google Cloud Platform, and Microsoft Azure have operationalized these codes in load-balancing and API gateway products, and CDNs including Akamai Technologies and Cloudflare map internal signals to these status responses.

Operational deployments at enterprises including PayPal, Square (company), and social platforms such as Instagram and Reddit influenced how implementers surfaced these codes in telemetry systems integrated with monitoring tools like Prometheus, Grafana, and log aggregation services from Splunk.

Security Considerations

The Security Considerations section highlights how the new codes interact with access control mechanisms used by identity providers such as OAuth implementers and federated services involving OpenID and enterprise directories like Active Directory. Misuse of the codes could facilitate traffic manipulation or information leakage in proxy environments managed by vendors like F5 Networks; guidance mirrors threat modeling approaches discussed at OWASP and in advisories by coordination groups such as CERT Coordination Center.

Operational security advice references protective measures familiar to teams at Cisco Systems, Juniper Networks, and hosting providers like DigitalOcean and emphasizes robust logging and rate-limiting configurations deployed in concert with incident response playbooks used by organizations including SANS Institute and US-CERT.

Category:Internet standards