]>

superuser@gmail.com

Google

warren@kumari.net

Google

rmsj@google.com

ART DISPATCH MIME protobuf media type application This document registers media types for Protocol Buffers, a common extensible mechanism for serializing structured data. About This Document The latest revision of this draft can be found at . Status information for this document may be found at . Discussion of this document takes place on the DISPATCH Working Group mailing list (), which is archived at . Subscribe at . Source for this draft and an issue tracker can be found at .

Introduction Protocol Buffers ("protobufs") were introduced in 2008 as a free, open source, platform-independent mechanism for transport and storage of structured data: their use has become increasingly common and Protobuf implementations exist in many languages (C++, C#, Dart, Go, Java, Kotlin, Objective-C, Python, JavaScript, Ruby, Swift, and perhaps others). See for more information. Protobuf consists of an interface definition language, wire encoding formats, and language-specific implementations (typically involving a generated API) so that clients and servers can be easily deployed using a common schema. Protobuf supports multiple wire formats for interchange: , which is optimized for wire efficiency, and , which maps the Protobuf schema onto a JSON structure. Serialized objects are occasionally transported within media that make use of media types (see et seq) to identify payloads. Accordingly, current and historical media types used for this purpose would benefit from registration. This document requests those registrations of IANA.

Payload Description These media types are used in the transport of serialized objects only. The IDL and object definitions, if transported, would be used with any appropriate text media type. In the three figures below, only the third of these would ever be used with these media types (a JSON example is depicted). An example use of the IDL to specify a "Person" object: An example of python code that uses code generated from the IDL definition above to create an instance of a "Person" object: An example of the above instance expressed in JSON:

Encoding Considerations Protobuf supports only the and for interchange, both of which are platform-independent. For binary forms that need to transit non-binary transports, a base64 Content-Transfer-Encoding (xref to ) is recommended.

Security Considerations The payload for these media types contain no directly executable code. While it is common for a protobuf definition to be used as input to a code generator which then produces something executable, but that applies to the schema language, not serializations. Protobuf provides no security, privacy, integrity, or compression services: clients or servers for which this is a concern should avail themselves of solutions that provide such capabilities (e.g. ). Implementations should be careful when processing Protobuf like any binary format: a malformed request to a protobuf server could be crafted to, for example, allocate a very large amount of memory, potentially impacting other operations on that server. In order to safely use Protobuf serializations on the web, it is important to ensure that they cannot be interpreted as another document type, such as JavaScript. For this reason, we recommend that binary protobuf serializations be wrapped in a Base64 Content-Transfer-Encoding according to . Further, when using JSON serializations it is important that it is clear to browsers that the content is pure JSON, so that they can inhibit Cross-Site Script Inclusion or side-channel attacks using techniques such as Cross-Origin Read Blocking (). Per , pure JSON content can be indicated by a +json subtype suffix (see also ); so when serializing Protobuf content to JSON, users MUST use the application/protobuf+json MIME type. Further, charset can prevent certain encoding confusion attacks so users should specify it for all JSON encodings. In the type there is technically a link, which was intended to be dereferenced to obtain schemas for a given type; however this is not supported by widely used Protobuf implementations.

IANA Considerations This document requests the registration of application/protobuf and application/protobuf+json as media types for Protobuf, and the notation of application/x-protobuf, application/x-protobuffer, and application/x-protobuf+json as deprecated aliases:

Registration for the "application/protobuf" Media Type Type name: application Subtype name: protobuf Required parameters: none Optional parameters:

• encoding, which indicates the type of Protobuf encoding and is "binary" by default for application/protobuf, indicating the format. Clients MUST reject JSON encodings without the +json subtype suffix and MUST reject unknown encodings. At the time of writing, no other encoding can be used for application/protobuf so this parameter is for extensibility.
• version, which indicates the version of the encoding specification. Clients MUST reject unknown version settings. At the time of writing, no protobuf encodings are versioned so this parameter is for extensibility.

Encoding considerations: binary Security considerations: see Interoperability considerations: The Protobuf specification includes versioning provisions to ensure backward compatibility when encountering payloads with unknown properties. Published specification: Applications that use this media type: Any application with a need to exchange or store structured objects across platforms or implementations. Fragment identifier considerations: None. Additional information: Person & email address to contact for further information: Protobuf <protobuf-team@google.com> Intended usage: COMMON Restrictions on usage: None Author: Rob Sloan <rmsj@google.com> Change controller: Protobuf <protobuf-team@google.com> Provisional registration? (standards tree only): No

Registration for "application/protobuf+json" Media Type Type name: application Subtype name: protobuf+json Required parameters: charset, which MUST be set to utf-8 (case-insensitive). Optional parameters:

• encoding, which indicates the type of Protobuf encoding and is json by default for application/protobuf+json, indicating the format. Clients MUST reject binary encodings with +json and MUST reject unknown encodings. At the time of writing, no other encoding can be used for application/protobuf+json so this parameter is for extensibility.
• version, which indicates the version of the encoding specification. Clients MUST reject unknown version settings. At the time of writing, no protobuf encodings are versioned so this parameter is for extensibility.

Encoding considerations: Same as encoding considerations of application/json as specified in , Section 11. Security considerations: see Interoperability considerations: The Protobuf specification includes versioning provisions to ensure backward compatibility when encountering payloads with unknown properties. Published specification: Applications that use this media type: Any application with a need to exchange or store structured objects across platforms or implementations. Fragment identifier considerations: None. Additional information: Person & email address to contact for further information: Protobuf <protobuf-team@google.com> Intended usage: COMMON Restrictions on usage: None Author: Rob Sloan <rmsj@google.com> Change controller: Protobuf <protobuf-team@google.com> Provisional registration? (standards tree only): No

Contact Please contact protobuf-team@google.com for requests to adjust this specification. Issues may be raised at https://github.com/protocolbuffers/protobuf.

References Normative References This initial document specifies the various headers used to describe the structure of MIME messages. [STANDARDS-TRACK] This second document defines the general structure of the MIME media typing system and defines an initial set of media types. [STANDARDS-TRACK] Mitra The purpose of this memo is to propose an update to Internet RFC 2045 to include a new primary content-type to be known as "model". [STANDARDS-TRACK] In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. This document changes RFC 2046 rules regarding default "charset" parameter values for "text/*" media types to better align with common usage by existing clients and servers. [STANDARDS-TRACK] This document defines procedures for the specification and registration of media types for use in HTTP, MIME, and other Internet protocols. This memo documents an Internet Best Current Practice. A content media type name sometimes includes partitioned meta- information distinguished by a structured syntax to permit noting an attribute of the media as a suffix to the name. This document defines several structured syntax suffixes for use with media type registrations. In particular, it defines and registers the "+json", "+ber", "+der", "+fastinfoset", "+wbxml" and "+zip" structured syntax suffixes, and provides a media type structured syntax suffix registration form for the "+xml" structured syntax suffix. This document is not an Internet Standards Track specification; it is published for informational purposes. This specification standardizes three media types -- application/xml, application/xml-external-parsed-entity, and application/xml-dtd -- for use in exchanging network entities that are related to the Extensible Markup Language (XML) while defining text/xml and text/ xml-external-parsed-entity as aliases for the respective application/ types. This specification also standardizes the '+xml' suffix for naming media types outside of these five types when those media types represent XML MIME entities. This memo serves to register and document the "font" top-level media type, under which subtypes for representation formats for fonts may be registered. This document also serves as a registration application for a set of intended subtypes, which are representative of some existing subtypes already in use, and currently registered under the "application" tree by their separate registrations. This document defines best practices for defining new top-level media types. It also introduces a registry for top-level media types, and contains a short history of top-level media types. It updates RFC 6838. This memo registers and documents the 'haptics' top-level media type, under which subtypes for representation formats for haptics may be registered. This document also serves as a registration for a set of subtypes, which are representative of some existing subtypes already in use. This document specifies IANA registration procedures for MIME external body access types and content-transfer-encodings. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. This document describes the commonly used base 64, base 32, and base 16 encoding schemes. It also discusses the use of line-feeds in encoded data, use of padding in encoded data, use of non-alphabet characters in encoded data, use of different encoding alphabets, and canonical encodings. [STANDARDS-TRACK] JavaScript Object Notation (JSON) is a lightweight, text-based, language-independent data interchange format. It was derived from the ECMAScript Programming Language Standard. JSON defines a small set of formatting rules for the portable representation of structured data. This document removes inconsistencies with other specifications of JSON, repairs specification errors, and offers experience-based interoperability guidance. n.d. Informative References This document specifies version 1.3 of the Transport Layer Security (TLS) protocol. TLS allows client/server applications to communicate over the Internet in a way that is designed to prevent eavesdropping, tampering, and message forgery. This document updates RFCs 5705 and 6066, and obsoletes RFCs 5077, 5246, and 6961. This document also specifies new requirements for TLS 1.2 implementations. Chromium n.d. WHATWG n.d. Protobuf n.d. Protobuf n.d. Protobuf n.d. Protobuf n.d. Protobuf n.d. Protobuf n.d.

Acknowledgments Orie Steele provided valuable feedback to this work.