Subject: Coming to a conclusion on draft-abarth-origin

From: Mark Nottingham <[email-masked]>
Date: Thu, 26 Feb 2009 12:23:19 +1100

To wrap up discussion of
   http://tools.ietf.org/html/draft-abarth-origin-00

I'd note that the draft does not identify an intended status, nor have  
we been asked for a review by the IESG or RFC Editor (which presumably  
they might do when publication is requested). As such, this is just a  
summary of the discussion to date.

It appears that, based on feedback on this list:
   1) there is little interest in implementing this header (at least  
in this community), and
   2) a number of people question the value of adding this new header,  
and
   3) a number of people believe that the Referer header could be used  
to achieve most of the goals of the draft.

To aid in (3), we have opened an issue
   http://trac.tools.ietf.org/wg/httpbis/trac/ticket/144

Adam, please help me clarify any points above which you don't believe  
are justified by discussion on this list. Also, I now you were working  
on a draft -01; if you still intend to publish it, we will of course  
be happy to provide feedback.

Cheers,

--
Mark Nottingham     http://www.mnot.net/

---

From: Adam Barth <[email-masked]>
Date: Wed, 25 Feb 2009 19:43:51 -0800

Thanks for your feedback on draft-abarth-origin-00.  Your feedback has
been very helpful.

On Wed, Feb 25, 2009 at 5:23 PM, Mark Nottingham <[email-masked]> wrote:
> Also, I now you were working on a
> draft -01; if you still intend to publish it, we will of course be happy to
> provide feedback.

This draft is based on feedback from this list and from browser
implementers.  If I do publish a -01 draft, I'll certainly welcome
additional feedback.

I'm quite interested in the idea of recommending or requiring that
user agents always send a Referer header (and letting them send the
value "null" if they have nothing better to send).  This design has
the distinct advantage of protecting Web sites that currently
implement lenient Referer validation.  My plan is to float this idea
with some browser security folks and see if they'd be willing to
implement it.

Adam