Hacker News Reader

Comment by einrealist | Hacker News Reader

If anyone wants to create a revision to RFC 9110 :)

  HTTP/1.1 309 Security Advisory
  Location: https://acme/aaargh-another-advisory

View on HN

410 Gone seems sufficient to differentiate from "this never existed".

But I want to specifically signal a security concern to the requesting party. For example, a artifact proxy (like Artifactory or CodeArtifact) can use this response to warn developers.

Structured data in body or HTTP header is plenty for that, no need for a HTTP status.

For example, if we were talking about a human-readable /crates/* page, returning 410 Gone with a HTML page explaining the situation to a human, that page could have a JSON-LD snippet explaining the same to a computer.

A dedicated status code + Location header allows to decouple the way an advisory is presented completely. At that location, there can be any representation, HTML or structured data like JSON-LD. The RFC extension would be small and clean.

Reply on news.ycombinator.com