Subject: Re: security impact of dropping charset default

From: Henrik Nordström <[email-masked]>
Date: Tue, 05 Feb 2008 16:03:55 +0100

tor 2008-01-24 klockan 11:30 -0500 skrev Yves Lafon:

> It would be a nice addition to describe the issue in general, not only for 
> HTML content, when UA are into the "content sniffing" business. It fits 
> well in the security section of HTTP.
> 
> The specific case of HTML needs also to be explained, but has its place in 
> a document reserved for browser implementors. I am pretty sure there is 
> already one that can be extended that way.

Adding a note in security considerations mentioning why servers explicit
intentions on content-type and/or charset or encoding MUST NOT be
secondguessed by sniffing sounds like a good idea to me.

Regards
Henrik

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 5 Feb 2008 07:34:35 -0800

Resolved as per:
   http://www3.tools.ietf.org/wg/httpbis/trac/ticket/20#comment:4

--
Mark Nottingham     http://www.mnot.net/