DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=gondrom.org;
 b=IZwesHhNWG/ZyA29tGPjYLLA1czKxFP+T64ojtTwmRCIRGB+u+utqfTrbKFP6331W3ZAlWT6D2N6mIssHyjh/WKkmp0/jrGy0zQWQP/jexBerfSjMROfmF8knxfhz+Fg;
 h=Received:Received:Message-ID:Date:From:User-Agent:MIME-Version:To:CC:Subject:X-Enigmail-Version:Content-Type;
Message-ID: <4D7FDD98.70500@gondrom.org>
Date: Tue, 15 Mar 2011 21:43:52 +0000
From: Tobias Gondrom <tobias.gondrom@gondrom.org>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US;
 rv:1.9.2.14) Gecko/20110221 SUSE/3.1.8 Lightning/1.0b2
 Thunderbird/3.1.8
MIME-Version: 1.0
To: websec@ietf.org
Content-Type: multipart/alternative;
 boundary="------------040408030800060803040205"
Cc: dross@microsoft.com
Subject: [websec] FYI: New draft draft-gondrom-frame-options-01
Precedence: list

This is a multi-part message in MIME format.
--------------040408030800060803040205
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

Hello dear fellow websec colleagues,

following up on some discussions at the OWASP Summit last month, David
Ross and I decided to write up a draft on Frame-Options (currently know
as X-Frame-Options) and to develop this further as a standard:
https://datatracker.ietf.org/doc/draft-gondrom-frame-options/

The draft is still a little bit rough on the edges and e.g. how it works
with websec-origin, but I hope we can sort out some of the details in
Prague and with your feedback on the mailing-list.

Kind regards,

Tobias


Ps.: and on a note as websec chair: although I believe this draft to be
relevant in websec scope, I submitted it as individual draft initially,
so we can have a first discussion and have a proper look for feedback
whether the WG wants to adopt this draft or not.



-------- Original Message --------
Subject: 	New Version Notification for draft-gondrom-frame-options-01
Date: 	Mon, 14 Mar 2011 16:19:55 -0700 (PDT)
From: 	IETF I-D Submission Tool <idsubmission@ietf.org>
To: 	tobias.gondrom@gondrom.org



A new version of I-D, draft-gondrom-frame-options-01.txt has been successfully submitted by Tobias Gondrom and posted to the IETF repository.

Filename:	 draft-gondrom-frame-options
Revision:	 01
Title:		 HTTP Header Frame Options
Creation_date:	 2011-03-15
WG ID:		 Independent Submission
Number_of_pages: 9

Abstract:
To improve the protection of web applications against Cross Site
Request Forgery (CSRF) and Clickjacking this standards defines a http
response header that declares a policy communicated from a host to
the client browser whether the transmitted content MUST NOT be
displayed in frames of other pages from different origins or a list
of trusted origins which are allowed to frame the content.
                                                                                  


The IETF Secretariat.




--------------040408030800060803040205
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  </head>
  <body text="#000000" bgcolor="#ffffff">
    Hello dear fellow websec colleagues, <br>
    <br>
    following up on some discussions at the OWASP Summit last month,
    David Ross and I decided to write up a draft on Frame-Options
    (currently know as X-Frame-Options) and to develop this further as a
    standard: <br>
    <a
      href="https://datatracker.ietf.org/doc/draft-gondrom-frame-options/">https://datatracker.ietf.org/doc/draft-gondrom-frame-options/</a><br>
    <br>
    The draft is still a little bit rough on the edges and e.g. how it
    works with websec-origin, but I hope we can sort out some of the
    details in Prague and with your feedback on the mailing-list. <br>
    <br>
    Kind regards, <br>
    <br>
    Tobias<br>
    <br>
    <br>
    Ps.: and on a note as websec chair: although I believe this draft to
    be relevant in websec scope, I submitted it as individual draft
    initially, so we can have a first discussion and have a proper look
    for feedback whether the WG wants to adopt this draft or not. <br>
    <br>
    <br>
    <br>
    -------- Original Message --------
    <table class="moz-email-headers-table" cellpadding="0"
      cellspacing="0" border="0">
      <tbody>
        <tr>
          <th nowrap="nowrap" valign="BASELINE" align="RIGHT">Subject: </th>
          <td>New Version Notification for
            draft-gondrom-frame-options-01</td>
        </tr>
        <tr>
          <th nowrap="nowrap" valign="BASELINE" align="RIGHT">Date: </th>
          <td>Mon, 14 Mar 2011 16:19:55 -0700 (PDT)</td>
        </tr>
        <tr>
          <th nowrap="nowrap" valign="BASELINE" align="RIGHT">From: </th>
          <td>IETF I-D Submission Tool <a class="moz-txt-link-rfc2396E" href="mailto:idsubmission@ietf.org">&lt;idsubmission@ietf.org&gt;</a></td>
        </tr>
        <tr>
          <th nowrap="nowrap" valign="BASELINE" align="RIGHT">To: </th>
          <td><a class="moz-txt-link-abbreviated" href="mailto:tobias.gondrom@gondrom.org">tobias.gondrom@gondrom.org</a></td>
        </tr>
      </tbody>
    </table>
    <br>
    <br>
    <pre>A new version of I-D, draft-gondrom-frame-options-01.txt has been successfully submitted by Tobias Gondrom and posted to the IETF repository.

Filename:	 draft-gondrom-frame-options
Revision:	 01
Title:		 HTTP Header Frame Options
Creation_date:	 2011-03-15
WG ID:		 Independent Submission
Number_of_pages: 9

Abstract:
To improve the protection of web applications against Cross Site
Request Forgery (CSRF) and Clickjacking this standards defines a http
response header that declares a policy communicated from a host to
the client browser whether the transmitted content MUST NOT be
displayed in frames of other pages from different origins or a list
of trusted origins which are allowed to frame the content.
                                                                                  


The IETF Secretariat.


</pre>
  </body>
</html>

--------------040408030800060803040205--