Allow both Token and String formats for quota policy identifiers

[Copilot]

Allow both Token and String formats for quota policy identifiers

Per IETF 124 working group decision ("Why not both"), quota policy identifiers can now use EITHER Token syntax (unquoted) OR String syntax (quoted). Both formats are valid and implementers can choose based on their naming needs.

Changes:

• Specification updates

  • RateLimit-Policy field: Item{{SF}} value MUST be either a Token{{SF}} or a String{{SF}}
  • RateLimit field: Item{{SF}} value MUST be either a Token{{SF}} or a String{{SF}}
  • Added explanatory text about when to use each format

• Examples (updated key examples to demonstrate both formats)

  • Updated examples to show both Token (unquoted) and String (quoted) formats
  • Some examples demonstrate mixed usage (both formats in same field)
  • Updated several examples to use two-word policy names with spaces (e.g., "per user", "basic rate", "day limit", "per hour", "per day") to better show when quoting is required
  • Added clarifying text explaining the flexibility

Format Options:

Token (unquoted): More compact but limited by Token syntax rules

• Cannot start with a digit
• Cannot contain spaces
• Example: burst, daily, permin

String (quoted): More flexible, any character sequence allowed

• Can start with a digit
• Can contain spaces (required for multi-word names)
• Example: "daily", "per hour", "per user", "basic rate"

Examples:

Both formats can be used independently or mixed:

RateLimit-Policy: burst;q=100;w=60,"daily";q=1000;w=86400
RateLimit-Policy: permin;q=50;w=60,"per hour";q=1000;w=3600
RateLimit-Policy: "per user";q=100;w=60;pk=:cHsdsRa894==:
RateLimit-Policy: "basic rate";q=100;w=60
RateLimit-Policy: "per hour";q=1000;w=3600, "per day";q=5000;w=86400
RateLimit: default;r=50;t=30
RateLimit: "default";r=300000000;t=60
RateLimit: "day limit";r=100;t=36000
RateLimit: "per day";r=100;t=36000

Aligns with RFC 9651 Structured Fields specification.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Should Quota Policy Items be SF token instead of SF String?</issue_title>
<issue_description>Current RateLimit-Policy fields look like this

RateLimit-Policy: "burst";q=100;w=60,"daily";q=1000;w=86400

The quota policy item is a SF String and so it must be quoted. If instead it was a SF Token, the field would look like this.

RateLimit-Policy: burst;q=100;w=60,daily;q=1000;w=86400

The decision to use string was based on the following text,

Note that Tokens are defined largely for compatibility with the data model of existing HTTP fields and may require additional steps to use in some implementations. As a result, new fields are encouraged to use Strings.

https://www.rfc-editor.org/rfc/rfc9651#section-3.3.4

If anyone has a good reason why we should change this, add a comment here.</issue_description>

Comments on the Issue (you are @copilot in this section)

@darrelmiller A discussion at IETF 124 working group meeting led to the following conclusion

</comment_new>

• Fixes Should Quota Policy Items be SF token instead of SF String? #158

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[darrelmiller]

@copilot I'm disappointed! The image was a "Why not both" meme. i.e. Users should be able to choose between using an unquoted token and being limited to not starting the policy with a digit and not being able to have spaces, or choosing to quote the string.

[Copilot]

@copilot I'm disappointed! The image was a "Why not both" meme. i.e. Users should be able to choose between using an unquoted token and being limited to not starting the policy with a digit and not b...

You're absolutely right - I misunderstood the decision! Updated the specification to allow BOTH Token (unquoted) and String (quoted) formats. Users can now choose based on their needs:

• Token: burst, daily - compact but can't start with digit or have spaces
• String: "daily", "per hour" - flexible, any characters allowed

Examples now show both formats, including mixed usage:

RateLimit-Policy: burst;q=100;w=60,"daily";q=1000;w=86400
RateLimit-Policy: permin;q=50;w=60,"per hour";q=1000;w=3600

Commit: 7f3121c

[darrelmiller]

@copilot Update a couple of the examples that use two words for the policy and put a space and quote them to show that either option works.

[Copilot]

@copilot Update a couple of the examples that use two words for the policy and put a space and quote them to show that either option works.

Updated examples to use two-word policy names with spaces throughout the document:

• "peruser" → "per user"
• "basic" → "basic rate"
• "dayLimit" → "day limit"
• "hour" → "per hour", "day" → "per day"

These demonstrate when quoting is required (for names with spaces) vs optional (for single tokens).

Commit: 3384801