Initialize, extend and shrink the Origin Set
03The Origin Set is per connection. The first successfully processed ORIGIN initializes it; later entries add members and 421 responses can remove one.
A 421 response to a request for https://img.example removes that origin if present. a.example and api.example remain. This is per-connection state, not a global ban.
Source for this drawing: RFC 8336 · Read RFC section 2.3 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
An empty frame initializes; a later frame adds rather than replaces.
- Before initialization, ordinary HTTP/2 coalescing rules apply. This state is not an initialized empty set.
- The initial origin uses https, lower-case TLS Server Name Indication (SNI), and the actual remote port. If SNI is absent, the remote IP address is used.
- Parse each ASCII-Origin as an ASCII origin serialization. A field that fails parsing MUST be ignored; continue with other entries. Wildcard names are not supported in entries.
- Subsequent ORIGIN frames incrementally add members. On 421 (Misdirected Request), clients MUST remove the corresponding request origin from this connection’s set, if present.
RFC 6454 § 6.2 supplies ASCII serialization. The executable teaching subset handles prepared canonical HTTPS names and selected invalid fields; it is not a complete origin/IDNA/IPv 6 parser. Offline fictional examples only. The illustrations assume certificate-check results; they do not perform those checks. MUST, SHOULD and MAY retain their RFC meanings; SHOULD exceptions require carefully weighing the implications.
Read the RFC section ↗