Subject: Sec-* headers

From: Bjoern Hoehrmann <[email-masked]>
Date: Mon, 21 Feb 2011 22:14:42 +0100

Hi,

  Over in the hybi Working Group the issue of "Sec-*" headers came up.
The XMLHttpRequest draft says "Header names starting with Sec- are not
allowed to be set to allow new headers to be minted that are guaranteed
not to come from XMLHttpRequest." It seems to me that if "Sec-*" headers
are somehow special, that is something the core specifications needs to
mention, like in the header registration specification, but I could not
find anything there from a quick look.

regards,
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 22 Feb 2011 09:18:18 +1100

Thanks, Bjoern. I think the underlying issue is whether a W3C draft should unilaterally make such a declaration; it's kind of a one-time thing. I.e., if another use case comes along and declares *their* special prefix, it'll be impractical.

I'll put on my liaison hat and bring it up with the W3C.

Cheers,

--
Mark Nottingham   http://www.mnot.net/

---

From: Adam Barth <[email-masked]>
Date: Mon, 21 Feb 2011 15:06:57 -0800

I'm not sure I quite follow.  The only thing special about Sec-
headers is that they can't be set using the XMLHttpRequest API.  That
seems like a reasonable thing for the XMLHttpRequest API to define
irrespective of other uses of HTTP.

Adam

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 22 Feb 2011 10:54:39 +1100

I'm following up on the [email-masked] list.

Thread continues here: <http://lists.w3.org/Archives/Public/public-webapps/2011JanMar/0618.html>

Cheers,