Is HTTP status code 426 Upgrade Required only meant signal an upgrade to a secure channel is required?

Question

Quoting one of my previous answers:

HTTP Upgrade is used to indicate a preference or requirement to
switch to a different version of HTTP or to another protocol, if
possible:
The Upgrade general-header allows the client to specify what 
additional communication protocols it supports and would like to use 
if the server finds it appropriate to switch protocols. The server 
MUST use the Upgrade header field within a 101 (Switching Protocols) 
response to indicate which protocol(s) are being switched.

      Upgrade        = "Upgrade" ":" 1#product

  For example,

     Upgrade: HTTP/2.0, SHTTP/1.3, IRC/6.9, RTA/x11

The Upgrade header field is intended to provide a simple mechanism 
for transition from HTTP/1.1 to some other, incompatible protocol.
According to the IANA register, there are only 3 registered
mentions of it (including one in the HTTP specification itself).

The other two are for:

Upgrading to TLS Within HTTP/1.1 (almost never used, not to
be confused with HTTP over TLS, which defines HTTPS as widely
used). This upgrade allows for a similar mechanism to STARTTLS in
other protocols (e.g. LDAP, SMTP, …) so as to be able to switch
to TLS on the same port as the plain connection, after exchanging some
of the application protocol messages, as opposed to having the entire
HTTP exchange on top of SSL/TLS without it needing to know it’s on top
of TLS (the way HTTPS works).

Upgrading to WebSockets (still a draft).

(The IANA register hasn’t changed since then.)

The 426 response code as defined in RFC 2817 clearly has to do with an upgrade in the “HTTP Upgrade” sense defined in RFC 2816. This is a change of the current protocol at the layer currently used (i.e. HTTP itself). (It’s not even about upgrading from http:// to https:// at all.)

The messages exchanged on top of HTTP (if part of a protocol at all) are not part of this. They’re just hypermedia entities as far as HTTP is concerned.

I don’t think 426 would be suitable if you change the meaning of your hypermedia. A plain 400 would probably be a better choice. Note that responses with error status codes (4xx, 5xx) do not prevent you from associating an entity in the response: this is where a message telling the client to upgrade your protocol (at that level) should be.

Leave a Comment Cancel reply