CycloneDX
Define logic to find port in well-known discovery
Currently, the port number is not part of the TEI but it is needed to connect to the API. The current assumption is that the client connects on the default https port (443). At this time, it is recommended that experimental clients add an optional port parameter, which allows to override the default port.
A port number cannot be added to the TEI URN spec as it breaks the location independence requirement of URN.
Possible solutions to this issue (there may be others not listed below):
- Make a convention that the port number for the ./well-known/tea is always 443. Exceptions possible via explicit client setting for non-production environments only.
- Use SRV or HTTPS DNS records to resolve the ./well-known/tea URL with the port number.
According to RFC 8615 the default port for the https scheme is the one .well-known URIs implicitly use:
Typically, applications will use the default port for the given scheme; if an alternative port is used, it MUST be explicitly specified by the application in question.
I don't see a reason why an alternative port should be used, except for tests.
I don't see a reason why an alternative port should be used, except for tests.
Thank you, this sounds reasonable. I think we just need to formally agree on this approach on the next meeting, unless there are other opinions.