Observation and experiments showed that in the vast majority of cases, CalDAV clients have typically ignored time zone definitions received from servers and instead use their own built-in definitions. This justifies servers unilaterally omitting VTIMEZONE components for standard IANA time zones when no CalDAV-Timezones header is present.

Servers should not remap an attendee's copy of an event to a standard time zone, because the organizer's calendar user agent will expect to see the original time zone definition in any iTIP replies sent by the attendee.

The primary motivation for this extension is that VTIMEZONE components can be larger octet-wise than the events or tasks that use them, and in many deployments these definitions are unchanging. This is especially problematic for mobile/limited devices with constrained bandwidth, CPU, and energy resources.

This specification only defines changes to iCalendar data exchanged via CalDAV; it does not apply to scheduling mechanisms based on iTIP (RFC5546) or iMIP (RFC6047) or other methods. This scope limitation avoids unintended interoperability issues with non-CalDAV calendar transports.

Clients MAY repeat a request using CALDAV:calendar-timezone (with full VTIMEZONE data) if the server rejects a CALDAV:calendar-timezone-id update with a CALDAV:valid-timezone error, providing a fallback for time zones unknown to the server.

Servers can preserve original non-standard time zone definitions supplied by clients, reject them with CALDAV:valid-timezone, or map them to standard equivalents. The chosen behavior must be consistent and clients must be prepared for any of these responses.

A CalDAV server supporting this specification MUST have one or more associated time zone distribution services (RFC7808) that provide data for the set of time zones known to the server and expected to be used by clients.

A server that supports this specification MUST include 'calendar-no-timezone' as a field in the DAV response header field from an OPTIONS request on a calendar home collection or calendar collection.

registry

Clients MUST check for the presence of the 'calendar-no-timezone' field in the DAV response header field before changing their behavior as per Section 4.

Clients MUST retrieve standard time zone definitions either from their own cache or from the set of time zone distribution servers advertised by the CalDAV server when the server does not include them in responses.

Clients MUST send time zone definitions in iCalendar data for any time zone identifiers not available via any of the server's advertised time zone distribution servers, and MUST be prepared for the server to reject such data or map the time zone to a standard one.

Clients SHOULD include an HTTP 'CalDAV-Timezones' request header field with value 'F' to ensure the CalDAV server does not include VTIMEZONE components in returned iCalendar data for time zones available from advertised distribution servers.

Clients SHOULD remove standard time zone definitions from iCalendar data they send to the server, provided the corresponding time zone identifier is available on any of the server's advertised time zone distribution servers.

If a client attempts to update CALDAV:calendar-timezone-id with a value not corresponding to a time zone known to the server, the server MUST reject the property update using a CALDAV:valid-timezone pre-condition error.

If a server cannot accept unknown/nonstandard time zones, it MUST reject the HTTP request containing such data using a WebDAV precondition code of CALDAV:valid-timezone.

Servers advertising 'calendar-no-timezone' capability MAY opt to not send standard VTIMEZONE components in the absence of a 'CalDAV-Timezones' request header field. Servers that do so MUST provide an administrator configuration setting to override this default behavior based on client User-Agent values.

Servers MUST support a client's ability to provide a time zone identifier for use in a calendar query REPORT using the new CALDAV:timezone-id XML element. If the identifier is unknown, the server MUST reject the request with a CALDAV:valid-timezone precondition error.

Servers MUST support the HTTP 'CalDAV-Timezones' request header field. If the header has value 'T', the server MUST include all appropriate VTIMEZONE components in returned iCalendar data; if 'F', the server MUST NOT return VTIMEZONE components for time zones available from advertised distribution servers, but MUST return VTIMEZONE for time zones not available from those servers.

The CALDAV:calendar-timezone-id WebDAV property MUST be present on all resources that also support the CALDAV:calendar-timezone WebDAV property, and its value MUST match the TZID of the VTIMEZONE component in CALDAV:calendar-timezone. The server MUST accept clients setting either property and MUST adjust the alternate property to reflect changes.

When making use of time zone data distribution services advertised by a CalDAV server, clients MUST follow all requirements of the time zone data distribution service protocol (RFC7808), taking care to refresh time zone data in a timely fashion.

An attacker could create a calendar event with a fake or rarely-used time zone identifier to monitor a calendar user's activity and interactions. The privacy mitigations in RFC7808 Section 9 SHOULD be applied; this specification increases the importance of those mitigations because it introduces additional time zone service interactions.

privacy, security

The CALDAV:calendar-query XML element is extended to allow use of either CALDAV:timezone or the new CALDAV:timezone-id element: <!ELEMENT calendar-query ((DAV:allprop | DAV:propname | DAV:prop)?, filter, (timezone | timezone-id)?)>.

The CALDAV:calendar-timezone-id WebDAV property allows clients to set the default time zone for a calendar collection using only a time zone identifier (PCDATA), as an alternative to providing the full VTIMEZONE component via CALDAV:calendar-timezone.

The CALDAV:timezone-id XML element (namespace urn:ietf:params:xml:ns:caldav) is an alternative to CALDAV:timezone in calendar query REPORT requests, allowing a client to specify a time zone by identifier rather than providing the full iCalendar VTIMEZONE data.

The CALDAV:timezone-service-set WebDAV property is defined on calendar home collections to list one or more time zone data distribution servers (RFC7808) that the CalDAV server uses to provide its set of standard time zone data.

The 'CalDAV-Timezones' HTTP request header field allows a client to indicate to the server whether it wants VTIMEZONE components returned in iCalendar data. Value 'T' requests time zone data; value 'F' requests omission of time zone data.

The 'CalDAV-Timezones' message header field has been added to the IANA Permanent Message Header Field Registry (RFC3864). Applicable protocol: http; status: standard; specification: RFC7809 Section 7.1.

registry

This specification introduces time zone data distribution service (RFC7808) servers as critical components in the calendaring architecture, creating a new attack vector. CalDAV server administrators SHOULD ensure that advertised time zone distribution servers are protected by a level of security commensurate with all other system components.

security

The CALDAV:calendar-timezone-id property contains PCDATA representing a time zone identifier string: <!ELEMENT calendar-timezone-id (#PCDATA)>. Similarly, CALDAV:timezone-id XML element is <!ELEMENT timezone-id (#PCDATA)>.

The CALDAV:timezone-service-set property contains one or more DAV:href elements, each carrying the URI of a time zone data distribution service: <!ELEMENT timezone-service-set (DAV:href+)>.

The CalDAV-Timezones header field has a single-character value: 'T' (include VTIMEZONE components) or 'F' (exclude VTIMEZONE components). Defined as: CalDAV-Timezones = "T" / "F".