Subject: TAG requests addition to section 3.2.1 of Part 3

From: [email-masked] (Henry S. Thompson)
Date: Fri, 18 Dec 2009 19:19:43 +0000

During its telcon of 2009-12-17 [1], the TAG agreed to request that
the following paragraphs be added at the end of section 3.2.1 of Part
3 of HTTP bis [2]:

  If the Content-Type header field _is_ present, a receipient which
  interprets the underlying data in a way inconsistent with the
  specified media type risks drawing incorrect conclusions.

  In practice, however, currently-deployed servers sometime provide a
  Content-Type header which does not correctly identify the content
  sent, with the result that some classes of recipients have adopted a
  policy of examining the content and overriding the specified type.

  Such 'sniffing' SHOULD NOT be done unless there is evidence that the
  specified media type is in error (for example, because it is
  'text/plain' but there are bytes in the data which are not legal for
  the specified or defaulted charset).  In any case recipients SHOULD
  NOT override the specified type if the change would significantly
  increase the security exposure ('privilege escalation').

  Deploying any heuristic for detecting mistaken Content-Types risks
  overriding user intentions and misrepresenting data---accordingly
  recipients SHOULD provide for users to disable sniffing in general
  and/or in particular cases.

Thank you,

ht, by and on behalf of the TAG

[1] http://tools.ietf.org/html/draft-ietf-httpbis-p3-payload-08#section-3.2.1
[2] http://www.w3.org/2001/tag/2009/12/17-minutes.html#item05
- -- 
       Henry S. Thompson, School of Informatics, University of Edinburgh
                         Half-time member of W3C Team
      10 Crichton Street, Edinburgh EH8 9AB, SCOTLAND -- (44) 131 650-4440
                Fax: (44) 131 651-1426, e-mail: [email-masked]
                       URL: http://www.ltg.ed.ac.uk/~ht/
[mail really from me _always_ has this .sig -- mail without it is forged spam]

---

From: Adam Barth <[email-masked]>
Date: Sun, 20 Dec 2009 17:44:16 -0800

This text looks good to me.  It strikes a balance between discouraging
sniffing and recognizing that some UAs will sniff.  I'd prefer that we
gave more precise advice, but you can't get everything you want in
life.  (Minor grammar nits below.)

On Fri, Dec 18, 2009 at 11:19 AM, Henry S. Thompson <[email-masked]> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>

which -> that

>  In practice, however, currently-deployed servers sometime provide a

currently-deployed -> currently deployed

>  Content-Type header which does not correctly identify the content

which -> that

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.6 (GNU/Linux)
>
> iD8DBQFLK9XPkjnJixAXWBoRAudxAJ9YZg70dC0piSh+34ftR5+X4n/y9wCdEHnw
> rWL3bWKkuX4nqIHyKmBQ4wI=
> =sZXk
> -----END PGP SIGNATURE-----
>
>

---

From: Anthony Bryan <[email-masked]>
Date: Sun, 20 Dec 2009 20:50:34 -0500

>>  If the Content-Type header field _is_ present, a receipient which

receipient -> recipient

-- 
(( Anthony Bryan ... Metalink [ http://www.metalinker.org ]
  )) Easier, More Reliable, Self Healing Downloads

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 30 Dec 2009 09:53:06 +1100

Henry,

As you may know, the WG has already extensively discussed Content Sniffing, in <http://trac.tools.ietf.org/wg/httpbis/trac/ticket/155>, and we thought we were in a position to consider the issue closed.

The discussions leading up to the current text were voluminous (search the mail archives for messages with a subject including "155" and/or "sniff"), so while we can certainly talk about adding more, I'm reluctant to do so unless we get good review. In particular, has the TAG coordinated this proposal with the HTML5 WG?

Regards,

--
Mark Nottingham     http://www.mnot.net/