RFC 8674 / START HERE
Safe preference, before the details
The “safe” HTTP preference
Prefer: safe asks a website to avoid content it considers objectionable. The site defines the criteria and may ignore the request. RFC 8674 is an Informational Independent Stream publication, not an IETF standard.
The idea in one picture
A client requests site-defined safer content
A site may apply and acknowledge its criteria
The client still has no safety or age guarantee
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
A client can express a preference across participating sites without pretending that a browser switch can enforce the content a site returns. The guide explains cooperation, HTTPS restrictions, cache variation and privacy limits.
A familiar example
A fictional HTTPS client sends Prefer: safe. A cooperating site applies its documented criteria and may reply Preference-Applied: safe. Without that acknowledgement, application remains unknown. Neither response proves age or guarantees safe content.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Request a preference, not a guaranteeA client can send Prefer: safe to request content it finds less objectionable. The receiving site defines what that means and may ignore the preference.→
- Choose when to send itThe safe preference can accompany HTTPS requests. A plain HTTP request must not carry it, and privacy choices can also call for omitting it.→
- Site criteria and stored settingsDifferent sites can define safer content differently. A site with several levels needs a documented default and a way to resolve local settings while honoring the incoming preference.→
- Keep cache variants apartWhen a cacheable response can change with Prefer, caches need that field in Vary on both preferred and default responses. A private response is an alternative for preventing shared storage.→
- Limits: identity and visibilityThe field cannot prove someone’s age or force a site to cooperate. HTTPS protects transport but the receiving site still learns the expressed preference.→
This introduction explains RFC 8674 (2019). Read the original RFC ↗