由 HTTP 增强的 ABNF:#symbol 的规范参考

ABNF augmented by HTTP : normative reference for #symbol

上下文

解决 CORS 问题,我想知道 HTTP 响应的有效值是什么 header Access-Control-Allow-Headers.

Whatwg CORS spec on header syntax 在 ABNF 中告诉我:

Access-Control-Allow-Headers = #field-name

RFC7230 告诉我:

field-name     = token
token = 1*tchar
tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." / "^" / "_" / "`" / "|" / "~" / DIGIT / ALPHA

另外,Whatwg states那:

ABNF means ABNF as augmented by HTTP (in particular the addition #) and RFC 7405. [RFC7405]

好的,我现在知道这个回复header是无效的:

Access-Control-Allow-Headers: Origin, Content-Type, content type, Accept, Authorization

field-name 不应包含白色 space,但这引出了我的问题:

问题

whatwg ABNF中#symbol的规范参考在哪里?它不是定义 ABNF 语法的 RFC5234 。我猜这是一个逗号分隔的字段,但我没有找到真正的参考。

PS:问题不是“Access-Control-Allow-Headers 的有效值是什么”

这个 “由 HTTP 增强(特别是添加 #)” 来自 RFC 7230 - Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing section 7. ABNF List Extension: #rule:

A #rule extension to the ABNF rules of [RFC5234] is used to improve readability in the definitions of some header field values.

A construct "#" is defined, similar to "*", for defining comma-delimited lists of elements. The full form is "<n>#<m>element" indicating at least <n> and at most <m> elements, each separated by a single comma (",") and optional whitespace (OWS).

In any production that uses the list construct, a sender must not generate empty list elements. In other words, a sender must generate lists that satisfy the following syntax:

1#element => element *( OWS "," OWS element )

(...)

因此 #field-name 变为“零个或多个 field-name(以逗号分隔并由可选的线性空格包围)”,因为 n 和 m 分别默认为 0 和无穷大。