Re: [websec] Ted Lemon's No Objection on draft-ietf-websec-x-frame-options-09: (with COMMENT)

[Ted Lemon <[e-mail]>]

On Aug 14, 2013, at 5:07 PM, Tobias Gondrom <[e-mail]> wrote:
> I had the hope with referring to RFC6454 this should be unambiguous and
> clear enough. I had the hesitation to write redundant text, but maybe I
> got too short. Do you think we need to spell it out more explicitly in
> the draft so people understand?

How about:

  Existing implementations differ with [RFC6454] in that origins with
  the same protocol but different port values are considered equivalent.

>> What is the distinction between "top-level browsing context" and "origin
>> of the framing page?"   A reference here would be helpful.
> Apologies. In this case I have hesitations to add an explanation about
> the nesting of frames in html. In general the concept of nested frames
> (and top-level vs. framing page) is reasonably understood.
> [will keep the text as is until I hear an argument that this really
> needs an explanation in this draft.]

The additional text that you added in your reply helps a little—it appears that "top-level browsing context" means "the HTML that is loaded first and that contains whatever nesting might occur" and perhaps that "origin of the framing page" refers somehow to the idea of nested frames.   But even with the help you've given me in your reply, I am not sure that I have this right, and indeed I am scratching my head trying to figure out what the difference is between these two contexts.

As a person who writes HTML fairly regularly, I think I am your intended target audience.   If so, you really do need to explain what these terms mean, or provide a reference to a document that explains them.