Subject: [hybi] Sec- headers from server?

From: Greg Wilkins <[email-masked]>
Date: Fri, 8 Apr 2011 08:45:17 +1000

I've asked this question in several threads, but never got a response.
 So I'll give it it's own thread.

Why are we putting Sec- on headers from the server?    My
understanding is that Sec- is a browser XHR mechanism that prevents js
code sending these headers.
No such mechanism exists on the server side and thus the Sec- prefix
is meaningless in that direction.  Worse still, it may give some false
impression of security.

Can we just drop the Sec- prefix from all server sent headers?

regards

---

From: David Endicott <[email-masked]>
Date: Fri, 8 Apr 2011 00:25:34 -0400

I assumed it was for symmetry.

I filed it under "harmless" and haven't worried about it.

I hope nobody would assume anything from just the name of a header string.
Heck, when I see "Security", I think of a financial instrument with periodic
interest payments, so I didn't attach any special significance to "Sec-"
headers.

But you do make a valid point - it does imply something that isn't
necessarily true.

On Thu, Apr 7, 2011 at 6:45 PM, Greg Wilkins <[email-masked]> wrote:

> _______________________________________________
> hybi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hybi
>