[apps-discuss] Forwarded draft: registration policy

[Mark Nottingham <[e-mail]>]

Draft -09 changed the registration policy for forwarded parameters:

> The "Forwarded" header field contains parameters for which IANA is to
>    create and maintain a new registry entitled "HTTP Forwarded
>    parameters".  Initial registrations are given below; for future
>    assignments, the registration procedure to be used is IETF review [RFC5226].

<http://www.ietf.org/rfcdiff?url2=draft-ietf-appsawg-http-forwarded-09>

I *think* this change was based upon Stephen's comment:

> Section 9 says only that the expert should ensure that the
> specification "address the security and privacy implications of the
> requested parameter." So if I defined a parameter that passed on the
> precise location of the end-user or the most recent healthcare
> related URL they've accessed then would that be ok? I think
> additional instructions are needed as to the acceptable purposes to
> which such parameters can be put or else perhaps IETF review would
> in fact be better. Given the field of applicability I would not be
> surprised if very privacy-invasive parameters were defined in
> future.


<https://datatracker.ietf.org/doc/draft-ietf-appsawg-http-forwarded/ballot/>

For the record, I question whether IETF Review is necessary for this registry, because it sets it up as a gatekeeper, rather than a registry of deployed parameters. 

I strongly suspect vendors will give in to the temptation to deploy unregistered parameters here, meaning we'll be publishing yet another registry that's both disconnected from reality and failing to serve the purported purpose (protecting security and privacy).

Regards,

--
Mark Nottingham   http://www.mnot.net/