[websec] FYI: New draft draft-gondrom-frame-options-01

[Tobias Gondrom <[e-mail]>]

Hello dear fellow websec colleagues,

following up on some discussions at the OWASP Summit last month, David
Ross and I decided to write up a draft on Frame-Options (currently know
as X-Frame-Options) and to develop this further as a standard:
https://datatracker.ietf.org/doc/draft-gondrom-frame-options/

The draft is still a little bit rough on the edges and e.g. how it works
with websec-origin, but I hope we can sort out some of the details in
Prague and with your feedback on the mailing-list.

Kind regards,

Tobias


Ps.: and on a note as websec chair: although I believe this draft to be
relevant in websec scope, I submitted it as individual draft initially,
so we can have a first discussion and have a proper look for feedback
whether the WG wants to adopt this draft or not.



-------- Original Message --------
Subject: 	New Version Notification for draft-gondrom-frame-options-01
Date: 	Mon, 14 Mar 2011 16:19:55 -0700 (PDT)
From: 	IETF I-D Submission Tool <[e-mail]>
To: 	[e-mail]



A new version of I-D, draft-gondrom-frame-options-01.txt has been successfully submitted by Tobias Gondrom and posted to the IETF repository.

Filename:	 draft-gondrom-frame-options
Revision:	 01
Title:		 HTTP Header Frame Options
Creation_date:	 2011-03-15
WG ID:		 Independent Submission
Number_of_pages: 9

Abstract:
To improve the protection of web applications against Cross Site
Request Forgery (CSRF) and Clickjacking this standards defines a http
response header that declares a policy communicated from a host to
the client browser whether the transmitted content MUST NOT be
displayed in frames of other pages from different origins or a list
of trusted origins which are allowed to frame the content.
                                                                                  


The IETF Secretariat.