Account Options

  1. Sign in
The old Google Groups will be going away soon.
Switch to the new Google Groups.
Google Groups Home
« Groups Home
mozilla.dev.security
+ new post
About this group
Subscribe to this group
This is a Usenet group - learn more
Message from discussion Content Security Policy - final call for comments
The group you are posting to is a Usenet group. Messages posted to this group will make your email address visible to anyone on the Internet.
Your reply message has not been sent.
Your post was successful
 
From:
To:
Cc:
Followup To:
Add Cc | Add Followup-to | Edit Subject
Subject:
Validation:
For verification purposes please type the characters you see in the picture below or the numbers you hear by clicking the accessibility icon. Listen and type the numbers you hear
 
Bil Corry  
View profile  
 More options Apr 7 2009, 4:40 pm
Newsgroups: mozilla.dev.security
From: Bil Corry <b...@corry.biz>
Date: Tue, 07 Apr 2009 15:40:14 -0500
Local: Tues, Apr 7 2009 4:40 pm
Subject: Re: Content Security Policy - final call for comments
Print | View thread | Show original | Report this message | Find messages by this author
Brandon Sterne wrote on 4/7/2009 12:02 PM:

> I looked at each of the HTTP Header Field Definitions and my preference
> for communicating the CSP version is to add a product token [1] to the
> User-Agent [2] string.  This would add only a few bytes to the U-A and
> it saves us the trouble of having to go through IETF processes of
> creating a new request header.

I agree that creating a request header for just the CSP version is overkill.  However, I am concerned that privacy add-ons, proxies, firewalls, etc may strip or replace the User-Agent string.

I propose a new request header is created, but instead of one that is specific to CSP, it is something more generic that can be used in the future by similar policy frameworks.

For example:

        Accept-Header: X-Content-Security-Policy version=2 securityLevel=2; X-Application-Boundaries-Enforcer type=browser

FWIW, "X-Application-Boundaries-Enforcer" refers to ABE: http://hackademix.net/2008/12/20/introducing-abe/

I originally came up with Accept-Header during a conversation about revising the Cookie specification; it would alert the server that the client understood "version 3" of cookies:

        Accept-Header: Set-Cookie version=3

So it does have a variety of uses that may make it worth the effort to register and define.

- Bil


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
Create a group - Google Groups - Google Home - Terms of Service - Privacy Policy
©2012 Google