Subject: CSRF and clickjacking not mentioned in "HTTP/1.1, part 7: Authentication"

From: Tyler Close <[email-masked]>
Date: Wed, 25 Nov 2009 07:01:14 -0800

The "Security Considerations" section of "HTTP/1.1, part 7:
Authentication" should mention that the mechanism is vulnerable to
Confused Deputy attacks such as Cross-Site-Request-Forgery (CSRF) and
clickjacking. Is someone working on text for this, or should I propose
some?

See:
http://tools.ietf.org/html/draft-ietf-httpbis-p7-auth-08#section-5

--Tyler

-- 
"Waterken News: Capability security on the Web"
http://waterken.sourceforge.net/recent.html

---

From: Julian Reschke <[email-masked]>
Date: Wed, 25 Nov 2009 16:18:19 +0100

Tyler Close wrote:
> ...

Hi Tyler,

as far as I can tell, nobody is currently working on this.

I can't speak for the whole group, but I would be *very* happy if you 
would look not only at Part 7, producing proposals on what should be 
said. Note that we should be careful in adding too much text though; in 
the past we were working on a separate spec, 
<http://tools.ietf.org/wg/httpbis/draft-ietf-httpbis-security-properties/>, 
which might be a better container for some of this.

Best regards, Julian