Re: [Unbearable] sec-token-binding header in the wild

I've occasionally seen the "Provisional headers are shown" message - I
think that comes up if the request is served from cache, in which case it
makes sense that there's no sec-token-binding header since there was no
request that went to a server.

On Wed, Feb 15, 2017 at 3:55 PM, John Bradley <ve7jtb@ve7jtb.com> wrote:

> Yes I see it.   The extension must have been filtering out those headers.
>
> I can’t explain what Jeff is seeing.
>
> John B.
>
> On Feb 15, 2017, at 8:49 PM, Nick Harper <nharper@google.com> wrote:
>
> I'm using the network tab of chrome's built-in dev tools to view the
> headers (Ctrl+Shift+I, or kebab menu > more tools > developer tools). As
> long as the flag is flipped in chrome://flags, it should be negotiating
> token binding, but I don't know how that extension might be interfering.
>
> On Wed, Feb 15, 2017 at 3:46 PM, John Bradley <ve7jtb@ve7jtb.com> wrote:
>
>> I tried 56.0.2924.87 and 58.0.3013.0 OSX  and 58,0,3007 (ChromeOS) with
>> no luck.
>>
>> It might be the extension to capture headers that is messing me up.
>>
>> What are you using.  I used the HTTP trace extension.
>>
>> John B.
>>
>> On Feb 15, 2017, at 8:36 PM, Nick Harper <nharper@google.com> wrote:
>>
>> I see the sec-token-binding header for both www.google.com and
>> www.chromium.org from chrome on os x (version 56.0.2924.87).
>>
>> On Wed, Feb 15, 2017 at 3:29 PM, John Bradley <ve7jtb@ve7jtb.com> wrote:
>>
>>> Strange I see them on both sites with Edge.
>>>
>>> With chrome on osx and windows I am not seeing them after turning on the
>>> flag and restarting.
>>>
>>> I don’t know if the header capture is messing with it somehow.
>>>
>>> Google.cl negotiated TB with Edge.
>>>
>>> John B.
>>>
>>> > On Feb 15, 2017, at 6:12 PM, =JeffH <Jeff.Hodges@KingsMountain.com>
>>> wrote:
>>> >
>>> > fyi/fwiw...
>>> >
>>> > target: https://www.chromium.org/
>>> >
>>> > sec-token-binding:AIkAAgBBQMaFRvLPy1uUBZer64ZluK8oBJ8kpcnO84
>>> kmCX29demwilh57_4gqlqRLBcZ_dh8x9KdN6TQQZWciZlGmhZp3sUAQFWhQB
>>> mwYSLGqlQ59KCOsYpn7Ex1dB_L5bAUTdEjd98Y5CY7NY6aczxi2gC7I6xEMA
>>> C4tONGdNOjoALTLt72REUAAA
>>> >
>>> > I used the built-in chrome developer tools to examine the request
>>> headers and obtain the above STB
>>> >
>>> >
>>> > [ innarestingly enuff, if one targets https://www.google.com/, it
>>> seems developer tools only displays the below...
>>> >
>>> > Provisional headers are shown
>>> > Referer:https://www.google.com/
>>> > User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6)
>>> AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
>>> > ]
>>> >
>>> >
>>> >
>>> >
>>> >
>>> >
>>> >
>>> >
>>> >
>>> >
>>> >
>>> >
>>> >
>>> >
>>> >
>>> >
>>> >
>>> > _______________________________________________
>>> > Unbearable mailing list
>>> > Unbearable@ietf.org
>>> > https://www.ietf.org/mailman/listinfo/unbearable
>>>
>>>
>>> _______________________________________________
>>> Unbearable mailing list
>>> Unbearable@ietf.org
>>> https://www.ietf.org/mailman/listinfo/unbearable
>>>
>>>
>>
>>
>
>