Status of This Memo

This is an Internet Standards Track document.¶

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841.¶

Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at https://www.rfc-editor.org/info/rfc8908.¶

Copyright Notice

Copyright (c) 2020 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.¶

Table of Contents

1. Introduction

This document describes a HyperText Transfer Protocol (HTTP) Application Programming Interface (API) that allows clients to interact with a Captive Portal system. The API defined in this document has been designed to meet the requirements in the Captive Portal Architecture [CAPPORT-ARCH]. Specifically, the API provides:¶

• The state of captivity (whether or not the client has access to the Internet).¶
• A URI of a user-facing web portal that can be used to get out of captivity.¶
• Authenticated and encrypted connections, using TLS for connections to both the API and user-facing web portal.¶

2. Terminology

This document leverages the terminology and components described in [CAPPORT-ARCH] and additionally defines the following terms:¶

Captive Portal Client

The client that interacts with the Captive Portal API is typically some application running on the user equipment that is connected to the captive network. This is also referred to as the "client" in this document.¶

Captive Portal API Server

The server exposing the APIs defined in this document to the client. This is also referred to as the "API server" in this document.¶

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

3. Workflow

The Captive Portal Architecture defines several categories of interaction between clients and Captive Portal systems:¶

1. Provisioning, in which a client discovers that a network has a captive portal and learns the URI of the API server.¶
2. API Server interaction, in which a client queries the state of captivity and retrieves the necessary information to get out of captivity¶
3. Enforcement, in which the enforcement device in the network blocks disallowed traffic.¶

This document defines the mechanisms used in the second category. It is assumed that the location of the Captive Portal API server has been discovered by the client as part of provisioning. A set of mechanisms for discovering the API server endpoint is defined in [RFC8910].¶

4. API Connection Details

The API server endpoint MUST be accessed over HTTP using an https URI [RFC2818] and SHOULD use the default https port. For example, if the Captive Portal API server is hosted at "example.org", the URI of the API could be "https://example.org/captive-portal/api".¶

The client SHOULD NOT assume that the URI of the API server for a given network will stay the same and SHOULD rely on the discovery or provisioning process each time it joins the network.¶

As described in Section 3 of [CAPPORT-ARCH], the identity of the client needs to be visible to the Captive Portal API server in order for the server to correctly reply with the client's portal state. If the identifier used by the Captive Portal system is the client's set of IP addresses, the system needs to ensure that the same IP addresses are visible to both the API server and the enforcement device.¶

If the API server needs information about the client identity that is not otherwise visible to it, the URI provided to the client during provisioning SHOULD be distinct per client. Thus, depending on how the Captive Portal system is configured, the URI will be unique for each client host and between sessions for the same client host.¶

For example, a Captive Portal system that uses per-client session URIs could use "https://example.org/captive-portal/api/X54PD39JV" as its API URI.¶

5. API State Structure

The Captive Portal API data structures are specified in JavaScript Object Notation (JSON) [RFC8259]. Requests and responses for the Captive Portal API use the "application/captive+json" media type. Clients SHOULD include this media type as an Accept header in their GET requests, and servers MUST mark this media type as their Content-Type header in responses.¶

The following key MUST be included in the top level of the JSON structure returned by the API server:¶

The following keys can be optionally included in the top level of the JSON structure returned by the API server:¶

The valid JSON keys can be extended by adding entries to the Captive Portal API Keys Registry (Section 8.2). If a client receives a key that it does not recognize, it MUST ignore the key and any associated values. All keys other than the ones defined in this document as "required" will be considered optional.¶

Captive Portal JSON content can contain per-client data that is not appropriate to store in an intermediary cache. Captive Portal API servers SHOULD set the Cache-Control header field in any responses to "private" or a more restrictive value, such as "no-store" [RFC7234].¶

Client behavior for issuing requests for updated JSON content is implementation specific and can be based on user interaction or the indications of seconds and bytes remaining in a given session. If at any point the client does not receive valid JSON content from the API server, either due to an error or due to receiving no response, the client SHOULD continue to apply the most recent valid content it had received or, if no content had been received previously, proceed to interact with the captive network as if the API capabilities were not present.¶

6. Example Interaction

Upon discovering the URI of the API server, a client connected to a captive network will query the API server to retrieve information about its captive state and conditions to escape captivity. In this example, the client discovered the URI "https://example.org/captive-portal/api/X54PD39JV" using one of the mechanisms defined in [RFC8910].¶

To request the Captive Portal JSON content, a client sends an HTTP GET request:¶

GET /captive-portal/api/X54PD39JV HTTP/1.1
Host: example.org
Accept: application/captive+json

The server then responds with the JSON content for that client:¶

HTTP/1.1 200 OK
Cache-Control: private
Date: Mon, 02 Mar 2020 05:07:35 GMT
Content-Type: application/captive+json

{
   "captive": true,
   "user-portal-url": "https://example.org/portal.html"
}

Upon receiving this information, the client will use it to direct the user to the web portal (as specified by the user-portal-url value) to enable access to the external network. Once the user satisfies the requirements for external network access, the client SHOULD query the API server again to verify that it is no longer captive.¶

When the client requests the Captive Portal JSON content after gaining external network access, the server responds with updated JSON content:¶

HTTP/1.1 200 OK
Cache-Control: private
Date: Mon, 02 Mar 2020 05:08:13 GMT
Content-Type: application/captive+json

{
   "captive": false,
   "user-portal-url": "https://example.org/portal.html",
   "venue-info-url": "https://flight.example.com/entertainment",
   "seconds-remaining": 326,
   "can-extend-session": true
}

7. Security Considerations

One of the goals of this protocol is to improve the security of the communication between client hosts and Captive Portal systems. Client traffic is protected from passive listeners on the local network by requiring TLS-encrypted connections between the client and the Captive Portal API server, as described in Section 4. All communication between the clients and the API server MUST be encrypted.¶

In addition to encrypting communications between clients and Captive Portal systems, this protocol requires a basic level of authentication from the API server, as described in Section 4.1. Specifically, the API server MUST present a valid certificate on which the client can perform revocation checks. This allows the client to ensure that the API server has authority for the hostname that was provisioned by the network using [RFC8910]. Note that this validation only confirms that the API server matches what the network's provisioning mechanism (such as DHCP or IPv6 Router Advertisements) provided; it is not validating the security of those provisioning mechanisms or the user's trust relationship to the network.¶

8. IANA Considerations

IANA has registered the "application/captive+json" media type (Section 8.1) and created a registry for fields in that format (Section 8.2).¶

Acknowledgments

This work was started by Mark Donnelly and Margaret Cullen. Thanks to everyone in the CAPPORT Working Group who has given input.¶

Authors' Addresses