Subject: Re: The HTTP Origin Header (draft-abarth-origin)

From: Bil Corry <[email-masked]>
Date: Sun, 12 Jul 2009 21:08:34 -0500

Adam Barth wrote on 6/25/2009 12:55 AM: 
> On Wed, Jun 24, 2009 at 10:46 PM, Mark Nottingham<[email-masked]> wrote:
>> Do you have a spec for sec-from?
> 
> http://tools.ietf.org/html/draft-abarth-origin-01
> 
> This draft addresses the technical feedback I have receive on the -00
> version of the draft.  As I said in the previous email, I'm going to
> try to reply to all the outstanding emails in the next couple of days.

How do you envision the Sec-From header representing frames?  I ask because the Mozilla Origin proposal[1] discusses frames quite a bit, and assuming frames are handled by Sec-From in the way outlined by Mozilla's proposal, they'll end up looking like redirect chains.

For example, based on your current draft (and correct me if I'm wrong) if A POSTs to B, which then redirects to C, the Sec-From header at C will look like:

	Sec-From: B A

Mozilla's frames proposal -- if A frames B which redirects to C, the header at C will look like:

	Sec-From: B A

There may be some value for C to be able to distinguish that a received request is coming from a frame.

- Bil

[1] https://wiki.mozilla.org/Security/Origin

---

From: Adam Barth <[email-masked]>
Date: Sun, 12 Jul 2009 19:35:18 -0700

On Sun, Jul 12, 2009 at 7:08 PM, Bil Corry<[email-masked]> wrote:
> How do you envision the Sec-From header representing frames?

The Sec-From header doesn't know anything about frames.

> I ask because the Mozilla Origin proposal[1] discusses frames quite a bit, and assuming frames are handled by Sec-From in the way outlined by Mozilla's proposal, they'll end up looking like redirect chains.

I believe they'll be updating their proposal by removing this discussion.

Adam