[weirds] Alissa Cooper's Discuss on draft-ietf-weirds-using-http-14: (with DISCUSS)

["Alissa Cooper" <[e-mail]>]

Alissa Cooper has entered the following ballot position for
draft-ietf-weirds-using-http-14: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-weirds-using-http/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

= Section 5.6 =
"When responding to queries, it is RECOMMENDED that servers use the
   Access-Control-Allow-Origin header field, as specified by
   [W3C.CR-cors-20130129].  As the use of RDAP is for public resources,
   a value of "*" is suitable for most cases."

What is the use case for cross-site RDAP queries?

Also, I am confused by the claim in the second sentence. The message that
I got from draft-ietf-weirds-rdap-sec and draft-ietf-weirds-json-response
is that one of the motivations for using HTTP for RDAP was that its
authentication features could be leveraged to provide tiered access to
data on the server, such that some of the data would not be public but
would be restricted to specific users (from
draft-ietf-weirds-json-response, Appendix A.1: "In many use cases, it is
necessary to hide or obscure the information of a registrant or contact
due to policy or other operational matters."). So it seems like if
cross-site requests are justified at all, there should be some text here
explaining when that might be the case and when not.