Re: [websec] Document Action: 'HTTP Header Field X-Frame-Options' to Informational RFC (draft-ietf-websec-x-frame-options-12.txt)

Yoav Nir <ynir@checkpoint.com> Wed, 28 August 2013 13:19 UTC

From: Yoav Nir <ynir@checkpoint.com>
To: websec mailing list <websec@ietf.org>
Thread-Topic: Document Action: 'HTTP Header Field X-Frame-Options' to Informational RFC (draft-ietf-websec-x-frame-options-12.txt)
Thread-Index: AQHOo/AuFmyVdfeG2kaGO5wouz4uTpmqaEOA
Date: Wed, 28 Aug 2013 13:19:22 +0000
Message-ID: <9ABB97BC-881D-4D43-B0EE-04954B6994F3@checkpoint.com>
References: <20130828131142.9621.2653.idtracker@ietfa.amsl.com>
In-Reply-To: <20130828131142.9621.2653.idtracker@ietfa.amsl.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-ID: <AD6D77F5D4684747AEE5023E162FE222@ad.checkpoint.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: Re: [websec] Document Action: 'HTTP Header Field X-Frame-Options' to Informational RFC (draft-ietf-websec-x-frame-options-12.txt)
Precedence: list

Congratulations.

Thanks to all who participated in the discussion, and special thanks to the document authors who took on this onerous (especially in the last two weeks) task. 

Yoav

On Aug 28, 2013, at 4:11 PM, The IESG <iesg-secretary@ietf.org> wrote:

> The IESG has approved the following document:
> - 'HTTP Header Field X-Frame-Options'
>  (draft-ietf-websec-x-frame-options-12.txt) as Informational RFC
> 
> This document is the product of the Web Security Working Group.
> 
> The IESG contact persons are Barry Leiba and Pete Resnick.
> 
> A URL of this Internet Draft is:
> http://datatracker.ietf.org/doc/draft-ietf-websec-x-frame-options/
> 
> 
> 
> 
> Technical Summary
> 
> This informational document serves to document the existing use and 
> specification of the X-Frame-Options HTTP response header field.
> 
> To improve the protection of web applications against Clickjacking,
> this definition describes the X-Frame-Options HTTP response header
> field that declares a policy communicated from the server to the
> client browser on whether the browser may display the transmitted
> content in frames that are part of other web pages.
> 
> Review and Consensus
> 
> In 2009 and 2010 many browser vendors introduced the use of a non-
> standard HTTP header field "X-Frame-Options" to protect against 
> Clickjacking. There have been differences between the various 
> implementations which may cause security and interoperability 
> concerns. This draft has been produced as informational by the websec 
> working group to document the current use and also to function as a 
> baseline for the future unified standard as part of the currently 
> produced Content Security Policy 1.1 (by WebAppSec at the W3C) - and 
> to get rid of the deprecated "X-" (see RFC6648). 
> 
> The review process took sufficient time and involved a medium amount 
> of people with deep browser security knowledge. During the review 
> process no major controversies came up, which is not too surprising 
> as the draft is intended as informational and documenting.
> 
> 
> Personnel
> 
> Yoav Nir is the Document Shepherd. Barry Leiba is the Responsible 
> Area Director.

[websec] Document Action: 'HTTP Header Field X-Fr… The IESG
Re: [websec] Document Action: 'HTTP Header Field … Yoav Nir