Re: Request-Off-The-Record Mode header

[Shivan Kaul Sahib <[e-mail]>]

Just a note that I published a -00 draft incorporating much of the feedback
to the IETF datatracker:
https://datatracker.ietf.org/doc/draft-sahib-httpbis-off-the-record/

On Thu, 8 Jun 2023 at 12:14, Shivan Kaul Sahib <[e-mail]>
wrote:

> Hi folks, this is a head's up and early request for feedback:
>
> Brave is shipping support for an HTTP response header sent by a website
> that wants the client to treat the website as "off-the-record" i.e. not
> store anything in storage, not record the site visit in history etc. Kind
> of like incognito/private browsing mode but site-initiated and only for a
> specific website. The header is simple: it would look like `Request-OTR:
> 1`. Some details here:
> https://brave.com/privacy-updates/26-request-off-the-record/#request-otr-header. Currently
> we bootstrap for websites that have expressed interest in this (mainly
> websites that have help resources for domestic violence victims, which was
> the driving use-case) by preloading a list of websites into the browser,
> but it would be nice to standardize the header. We're considering doing the
> work in the HTTP WG at IETF: it's envisioned to be a simple header.
>
> I see that this idea was previously discussed in W3C WebAppSec:
> https://lists.w3.org/Archives/Public/public-webappsec/2015Sep/0016.html,
> and there was a draft Mozilla spec:
> https://wiki.mozilla.org/Security/Automatic_Private_Browsing_Upgrades,
> though as a CSP directive.
>
> Happy to hear what people think.
>
>
>