Re: Reopening RFC6874?

[Fernando Gont <[e-mail]>]

Hi, Brian,

Thanks for raising this! In-line....

On Thu, 2021-06-17 at 11:58 +1200, Brian E Carpenter wrote:
[....]
> 
> The security considerations say:
> 
> >    An HTTP client, proxy, or other intermediary MUST remove any
> > ZoneID
> >    attached to an outgoing URI, as it has only local significance
> > at the
> >    sending host.

This dosen't seem to make a lot of sense. With the same logic, one
should remove non-global addresses from URIs.


> 
> There is also non-normative text saying:
> 
> >    However,
> >    URIs including a ZoneID have no meaning outside the originating
> > node.
> >    It would therefore be highly desirable for a browser to remove
> > the
> >    ZoneID from a URI before including that URI in an HTTP request.

What if one is browing a local app and, for some reason, employs e.g. a
link-local address?


> 
> As I understand it, those requirements are considered unreasonable
> and
> too hard to code by browser implementors. Also, there is a use case
> that Andrew Cardy can describe better than me where the deletion of
> the
> Zone ID breaks a higher-level protocol. (CUPS printing; Michael Sweet
> raised the issue on this list 8 years ago.)
> 
> Would the WG be interested in taking up this work? 

Me: Yes.

Thanks!

Regards,
-- 
Fernando Gont
Director of Information Security
EdgeUno, Inc.
PGP Fingerprint: DFBD 63E3 B248 AE79 C598 AF23 EBAE DA03 0644 1531