Re: [websec] #60: Well Known URIs vs Response Headers

On 01/08/13 02:53, Chris Palmer wrote:
> On Wed, Jul 31, 2013 at 4:50 PM, Trevor Perrin <trevp@trevp.net> wrote:
>
>> I don't see why this would be a blocking load.  I would expect it to
>> be done in the background, so have no latency impact.
> So are we supposed to send cookies (for example) to the server before
> finishing the W-K URI load?
>
> If I completely rewrite HPKP to be a W-K URI I-D encompassing all of
> HSTS, HPKP, and CSP (and what else?), does that actually have a chance
> of flying? Or would it be a waste of everyone's time? Keep in mind
> that including more people, including the authors of RFCs who think
> their work is done, will make for a very slow and expensive process.

<no hats>
I would not expect the draft to be extended to HSTS and CSP or other
things.
Only consider the approach for HPKP at this time.

Btw. a few thoughts:
personally I am not so comfortable with the resource part yet and would
still prefer the header, but like to do some more research before I make
any arguments.

And there might actually be another approach:
Finish HPKP as is with header and start a generic draft on moving
"everything" (extendable) to a resource location. Btw. we should also
start a discussion with W3C webappsec to learn what they think about it,
as CSP is done there.

Cheers, Tobias

> _______________________________________________
> websec mailing list
> websec@ietf.org
> https://www.ietf.org/mailman/listinfo/websec