DEV Community

Yaroslav Polyakov
Yaroslav Polyakov

Posted on

Great design trick I learned in X.509 (critical extension)

Good software, file formats and network protocols are extendable. You may develop new version later, but it should interoperate with older version. Old client software must work with new server and vice versa. Old software must open files created by new version of software and vice versa.

Extensions are good for this, but usually it comes with problem: How should software work, if it finds unknown extension? Often answer is simple - "just ignore it". Skip unknown extension and process file/request. (Same as your web app does if HTTP request has unknown header - it just does not looks at it)

But sometimes this approach will fail. Sometimes simple ignoring extension will not work (especially in security area). And here comes "critical extension". Extension has some identified and simple boolean flag "critical".

If software founds unknown extension it looks for flag. if not critical - ignore extension and go on. If critical - sorry, this software can not process this file/request (and it's very good if old software knows when it can process new data and when it should not try).

https://datatracker.ietf.org/doc/html/rfc5280

Top comments (0)