Re: [Ietf-message-headers] HTTP header registration question

[Martin Duerst <[e-mail]>]

I have just realized that I haven't seen any security issues
for this proposal described or discussed, although I think
that there may be quite some security issues connected to
phishing, which should be carefully analysed and described.

The scenario I'm thinking about is that a phishing site,
rather than as currently having to get the passwords from
the user to its server, and then from there contact the
real server, may be able to list the real server in
an Access-Control header and therewith may be able to
correspond directly between client and real server,
potentially circumventing some security checks that
were in place until now (e.g. a plausability check
for the IP address of the user,...).

Regards,   Martin.s


At 02:05 07/10/11, Anne van Kesteren wrote:
>On Wed, 10 Oct 2007 00:01:45 +0200, Graham Klyne <[e-mail]>  
>wrote:
>> My comments concern procedural matters - I make no judgement here about  
>> the technical content of the proposal...
>
>Feel free to make comments on the technical content though!
>
>
>> The registration would probably have to be provisional until such time  
>> as the specification documents achieve some kind of standard-equivalent  
>> status (e.g. W3C REC).  The status information is generally  
>> "provisional"  for headers in the provisional registry.  If this is W3C  
>> WG activity for which there is general consensus on the direction if not  
>> the final details, then I's suggest that provisional registration should  
>> be progressed sooner rather than later
>> (including a note of the venue for ongoing development of the  
>> specification).
>
>Ok. I believe that I can do that tomorrow as the two review weeks have  
>passed then. (I initially e-mailed it on Thu 27 Sep 2007.)
>
>
>> Three separate templates may be preferable - they will lead to separate  
>> entries in the registry.
>
>Ok.
>
>
>> With reference to other discussion, in which you said: "the other two  
>> are both mentioned and it's defined what they are to contain. (They are  
>> request headers.) Maybe they should have syntax definitions as well just  
>> to make it complete."
>>
>> ... I think it may help if:
>> (a) they had syntax definitions (or reference to some existing  
>> definition), and
>> (b) if it's not obvious, that there be some indication to where in the  
>> document the headers are defined (section number of suchlike).
>
>http://dev.w3.org/2006/waf/access-control/ now includes the syntax  
>definitions.
>
>
>> The standard of definition required will be higher for permanent  
>> registration.
>
>What are the requirements exactly?
>
>
>Thanks a lot by the way!
>
>
>-- 
>Anne van Kesteren
><http://annevankesteren.nl/>
><http://www.opera.com/>
>
>
>_______________________________________________
>Ietf-message-headers mailing list
>[e-mail]
>https://www1.ietf.org/mailman/listinfo/ietf-message-headers


#-#-#  Martin J. Du"rst, Assoc. Professor, Aoyama Gakuin University
#-#-#  http://www.sw.it.aoyama.ac.jp       mailto:[e-mail]     



_______________________________________________
Ietf-message-headers mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/ietf-message-headers