Better name for the "expires" attribute in Upload-Limit

[guoye-zhang]

Expires typically is an absolute timestamp, but it is a number of seconds in Upload-Limit. It might be better named as timeout or something similar.

[LPardue]

Some possible inspiration maybe?

https://www.ietf.org/archive/id/draft-ietf-httpapi-ratelimit-headers-08.html#section-3.1.3

The "w" parameter value conveys a time window applicable to the quota (Section 3.1.1). The time window MUST be a non-negative Integer value expressing an interval in seconds, similar to the "delay-seconds" rule defined in Section 10.2.3 of [HTTP]. Sub-second precision is not supported.

[smatsson]

Maybe we could use max-age as it is already used in other standards? Not a perfect 1:1 match but close enough?

max-age in RFC 9111 - https://www.rfc-editor.org/rfc/rfc9111.html#name-max-age-2

The max-age response directive indicates that the response is to be considered stale after its age is greater than the specified number of seconds.

access-control-max-age in CORS - https://fetch.spec.whatwg.org/#http-access-control-max-age

Indicates the number of seconds (5 by default) the information provided by the Access-Control-Allow-Methods and Access-Control-Allow-Headers headers can be cached.

Another idea could be expires-in but that is not in the list of registered IANA headers so might be more work than it's worth?

TTL could also possibly be used with the same argument as max-age?

TTL in RFC8030 - https://www.rfc-editor.org/rfc/rfc8030.html#page-11

An application server MUST include the TTL (Time-To-Live) header
field in its request for push message delivery. The TTL header field
contains a value in seconds that suggests how long a push message is
retained by the push service.

EDIT: On the other hand, these do not really convey the same thing. Upload-Limit -> Expires is the amount left before the upload expires while e.g. max-age is the total time and will be constant on each request while Expires will be smaller (or possibly larger) on each request.

[smatsson]

Another solution would be to change expires into a sf date: https://www.ietf.org/rfc/rfc9651.html#name-dates

[LPardue]

https://www.rfc-editor.org/rfc/rfc7838.html#section-3.1

Syntax:

ma = delta-seconds; see [RFC7234], Section 1.2.1

The delta-seconds value indicates the number of seconds since the
response was generated for which the alternative service is
considered fresh.

[Acconut]

Another solution would be to change expires into a sf date: https://www.ietf.org/rfc/rfc9651.html#name-dates

When we first discussed the Upload-Limit, the WG argued that relative durations are preferable to absolute timestamps as durations also work if the client and server don't have aligned clocks. That makes sense, so I would vote for keeping the current value but choosing a different name.

[Acconut]

Personally, I think

• max-age,
• expires-in, and
• timeout

are all good options. max-age/ma is already used in HTTP, although in the area of caching. expires-in is the most descriptive for me and would be my preference, but I can live with any other option as well. What is your preference?

[martinthomson]

"Expires-In" doesn't have an intuitive meaning for me. My immediate thought was "What does it expire in? A bucket? The back of a fridge?" "Expires-After" perhaps. However, why come up with NIH terminology where there is already a clearly established pattern that says "max-age" is the validity duration of a thing. We use that for more than just Cache-Control.

[Acconut]

Thank you for the input, Martin. Given that, it makes sense to reuse the terminology and I opened #3012 to change the name.