[websec] draft-ietf-websec-key-pinning-20 POST report format

Julian Reschke <julian.reschke@gmx.de> Tue, 26 August 2014 10:19 UTC

Message-ID: <53FC5F09.7080201@gmx.de>
Date: Tue, 26 Aug 2014 12:18:49 +0200
From: Julian Reschke <julian.reschke@gmx.de>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.0
MIME-Version: 1.0
To: websec <websec@ietf.org>
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Transfer-Encoding: 7bit
Archived-At: http://mailarchive.ietf.org/arch/msg/websec/QwsxOHWGMts0qCTI0rIv2EKHS74
Subject: [websec] draft-ietf-websec-key-pinning-20 POST report format
Precedence: list

Hi there,

this is about 
<http://tools.ietf.org/html/draft-ietf-websec-key-pinning-20#section-3>.

1) I believe it would be good if the example actually showed the full 
POST request so that it contains the media type.

2) Speaking of which: I assume the media type is supposed to be 
application/json?

Also, this essentially introduces a mechanism by which the UA will 
automatically send an unsafe HTTP request (POST) to a server which might 
have a different origin than the server triggering this. Are we sure 
that this doesn't introduce a new exploit? Maybe it would be better to 
at least use a non-generic media type instead?

Best regards, Julian

[websec] draft-ietf-websec-key-pinning-20 POST re… Julian Reschke