Subject: Re: Comments on the HTTP Sec-From Header (draft-abarth-origin)

From: "Anne van Kesteren" <[email-masked]>
Date: Wed, 12 Aug 2009 18:11:20 +0200

On Thu, 23 Jul 2009 04:21:41 +0200, Adam Barth <[email-masked]> wrote:
> I wonder if this syntax would work for CORS too?  We can take the
> discussion to web-apps if you like, but the idea is if you get a
> redirect (e.g., of a DELETE), then you can add a second Origin header
> to the request instead of modifying the existing header.

Yeah, what is needed is more discussion of this email:

  http://www.w3.org/mid/op.uvmhixlr64w2qv@annevk-t60

If someone helps me figure out what changes we want to make to how CORS deals with redirects we can definitely merge the two headers again.

-- 
Anne van Kesteren
http://annevankesteren.nl/

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 1 Sep 2009 13:37:54 +1000

Adam,

One thing -- AIUI Sec-From is sent with *all* requests, including GET.  
Furthermore, servers will make security-related decisions about the  
response based upon it.

As such, won't servers need to set

   Vary: Sec-From

in responses to asure that caches will do the right thing? Otherwise,  
a cache could respond to a cross-site request with a stored response  
improperly.

The latent problem here, BTW, is that some deployed cache  
implementations don't like Vary headers with any value other than  
'Accept-Encoding', refusing to cache such responses. This means that  
Sec-From is going to negatively impact caching on the Web, potentially  
quite severely (i.e., some browser as well as intermediary caches  
won't work at all).

Cheers,

On 29/06/2009, at 9:12 AM, Adam Barth wrote:

> On Wed, Jun 24, 2009 at 10:55 PM, Adam Barth<[email-masked]> wrote:
>> On Wed, Jun 24, 2009 at 10:46 PM, Mark Nottingham<[email-masked]>  
>> wrote:
>>> Do you have a spec for sec-from?
>>
>> http://tools.ietf.org/html/draft-abarth-origin-01
>>
>> This draft addresses the technical feedback I have receive on the -00
>> version of the draft.  As I said in the previous email, I'm going to
>> try to reply to all the outstanding emails in the next couple of  
>> days.
>
> Turns out my folder of outstanding issues was mostly individual
> emails.  I had an outstanding request for data from this WG on the
> number of internal-to-external POST requests.  Out of a sample of one
> million HTTP requests from an enterprise firewall:
>
> 1) 6% of the GET+POST requests were POST.
> 2) 10% of POSTs are cross-host.
> 3) There was exactly one POST from an internal host to an external  
> host.
>
> Caveats: I can't see HTTPS traffic with this methodology.  Different
> enterprises might be different.  The enterprise in question does trip
> the Referer header (although I collected the data prior to stripping).
>
> Adam
>

--
Mark Nottingham     http://www.mnot.net/