[quicwg/base-drafts] Introduce a bit to indicate the server doesn't do IP-based authentication (#1993)

[Anne van Kesteren <[e-mail]>]

Web browsers have needed to invent a variety of schemes to talk to servers, such as the [CORS protocol](https://fetch.spec.whatwg.org/#http-cors-protocol) for HTTP and WebSocket as some kind of TCP, to avoid allowing `attacker.example` access to IP-authenticated data (e.g., intranets without the best security setup).

It'd be nice if this kind of thing could be done at the base protocol level. This would also allow browsers to expose a QUIC^W??? API to communicate with arbitrary servers that have the relevant bit set. (If such an API saw adoption that might also be a further incentive for middleware to get their act together.)

This would not obviate the need for something like CORS entirely, as requests containing cookies or HTTP authentication data would still require explicit consent, but it would allow browser-based applications to more usefully take part in the ecosystem.

cc @jakearchibald

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/1993