Subject: draft-ietf-httpbis-bcp56bis-11, "4.14. Maintaining Application Boundaries"

From: Julian Reschke <[email-masked]>
Date: Mon, 5 Apr 2021 18:46:21 +0200

> Because the origin [RFC6454] is how many HTTP capabilities are scoped, applications also need to consider how deployments might interact with other applications (including Web browsing) on the same origin.

Maybe this should refer to the relevant section in SEMANTICS (4.3.1)
instead (or in addition).

Best regards, Julian

---

From: Mark Nottingham <[email-masked]>
Date: Mon, 19 Apr 2021 17:20:15 +1000

I don't think so, unless we want to deprecate that RFC (which AFAICT hasn't yet been discussed).

> On 6 Apr 2021, at 2:46 am, Julian Reschke <[email-masked]> wrote:
> 

--
Mark Nottingham   https://www.mnot.net/

---

From: Julian Reschke <[email-masked]>
Date: Mon, 19 Apr 2021 10:11:25 +0200

Am 19.04.2021 um 09:20 schrieb Mark Nottingham:
> ...

I don't see how that would follow.

BCP56bis is commentary on top of the HTTP specs, and those have switched
to their own definition of "Origin", so it might make sense to be
consistent with that.

Best regards, Julian

---

From: Mark Nottingham <[email-masked]>
Date: Mon, 19 Apr 2021 18:13:10 +1000

BCP56bis is a set of recommendations for applications that build on top of HTTP, not just commentary on those specs. In particular, the section you're referring to is talking about browser mechanisms for security, which do *not* reference HTTP for this definition; they reference Origin.

Cheers,

> On 19 Apr 2021, at 6:11 pm, Julian Reschke <[email-masked]> wrote:
>

---

From: Julian Reschke <[email-masked]>
Date: Mon, 19 Apr 2021 10:20:50 +0200

> BCP56bis is a set of recommendations for applications that build on top of HTTP, not just commentary on those specs. In particular, the section you're referring to is talking about browser mechanis…
Hmm. HTML5 has its own definition: <https://html.spec.whatwg.org/#origin>.

Best regards, Julian

---

From: Mark Nottingham <[email-masked]>
Date: Mon, 19 Apr 2021 18:22:27 +1000

You shock me; they've never done *that* before.

> On 19 Apr 2021, at 6:20 pm, Julian Reschke <[email-masked]> wrote:
>

---

From: "Roy T. Fielding" <[email-masked]>
Date: Mon, 19 Apr 2021 09:28:24 -0700

> On Apr 19, 2021, at 1:22 AM, Mark Nottingham <[email-masked]> wrote:
> 

RFC6454 was abandoned by WHATWG before the ink dried. The reason we
did not obsolete it in Semantics is because 6454 is specifically for user agents
and defines the Origin header field, whereas the actual origin concept it uses
came from the HTTP standard (as in, the origin server).

HTTP has added a string definition of origin consistent with both RFC6454
and HTML, specifically to define the processing of authority for https, but
without defining the browser-specific processing requirements of HTML.

If the sentence is about the origin concept of HTTP, it should reference HTTP Semantics.

If it is about javascript processing within an HTML context, not specific to HTTP, then
it should reference HTML.

If it is about the Origin header field, it should reference RFC6454.

Or it can just reference all three and call it a day.

....Roy

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 21 Apr 2021 12:00:07 +1000

> On 20 Apr 2021, at 2:28 am, Roy T. Fielding <[email-masked]> wrote:
> 
...
> Or it can just reference all three and call it a day.

The following W3C specs currently defer to 6454 for the definition of 'origin' (the concept):

https://www.w3.org/TR/referrer-policy/
https://www.w3.org/TR/CSP2/
https://www.w3.org/TR/SRI/

Fetch says that it deprecates (hah) the Origin header, but not the concept. HTML defines the term but does not state its relationship to 6454.

Regardless, of all of the possible references here, 6454 is the best because it actually explains the higher-level concepts regarding trust and the same-origin policy (which isn't documented anywhere well, but is at least discussed here). That's the point of the reference; giving three references is overkill, and unfriendly to readers.

Cheers,

---

From: Jeffrey Yasskin <[email-masked]>
Date: Wed, 21 Apr 2021 14:47:05 -0700

On Tue, Apr 20, 2021 at 7:23 PM Mark Nottingham <[email-masked]> wrote:

> https://www.w3.org/TR/referrer-policy/ (2017)
> https://www.w3.org/TR/CSP2/ (2016)
> https://www.w3.org/TR/SRI/ (2016)

The newest versions of these:
https://w3c.github.io/webappsec-referrer-policy/,
https://w3c.github.io/webappsec-csp/, and
https://w3c.github.io/webappsec-subresource-integrity/, no longer refer to
RFC 6454. This comment doesn't imply any position on the substantive
question in this thread.

Jeffrey