Subject: Re: [httpwg/http-extensions] Form-encode Expect-CT report bodies? (#356)

From: HTTP issue updates <[email-masked]>
Date: Tue, 06 Jun 2017 09:58:37 -0700

Use an HTTP method other than POST?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/356#issuecomment-306550487

---

From: HTTP issue updates <[email-masked]>
Date: Tue, 06 Jun 2017 10:42:43 -0700

@reschke that doesn't resolve the issue; preflight requests are required as long as there is a non-whitelisted `Content-Type` header of application/json.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/356#issuecomment-306562932

---

From: HTTP issue updates <[email-masked]>
Date: Tue, 06 Jun 2017 10:50:56 -0700

That would be a bug in CORS. No preflight is needed if the HTTP method by definition can not ve generated by an HTML form.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/356#issuecomment-306565235

---

From: HTTP issue updates <[email-masked]>
Date: Tue, 06 Jun 2017 11:10:52 -0700

That's not a bug in CORS, it's exactly the point of CORS -- to prevent requests that cannot be generated by legacy web content (for example, via an `img` tag or an HTML form submission) unless the server opts in.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/356#issuecomment-306570997

---

From: HTTP issue updates <[email-masked]>
Date: Tue, 06 Jun 2017 11:15:44 -0700

Yes.

But form content and links can only generate GET, HEAD and POST requests.

I was suggesting to use a different method than these.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/356#issuecomment-306572317

---

From: HTTP issue updates <[email-masked]>
Date: Tue, 06 Jun 2017 11:27:16 -0700

But CORS also disallows non-GET/HEAD/POST methods without a preflight, and that's not a bug; it's because servers might rely on web content not being able to generate those methods and would be vulnerable if web content could send such requests.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/356#issuecomment-306575547

---

From: HTTP issue updates <[email-masked]>
Date: Tue, 06 Jun 2017 11:30:51 -0700

Yes, indeed. I was temporarily confused.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/356#issuecomment-306576546

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 19 Jun 2017 16:44:54 -0700

After further discussion on the list (https://lists.w3.org/Archives/Public/ietf-http-wg//2017AprJun/0168.html), I suppose we should leave things as they are: leave it up to the UA to decide if and how to send preflights, with the report-collection server advised to expect preflights from some clients ("The UA MAY perform other operations as part of sending the HTTP POST request, for example sending a CORS preflight as part of [FETCH]").

While it isn't feasible to implement true preflights in a network stack like Chrome's, we could feasibly implement null-origin preflights for Expect-CT reports.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/356#issuecomment-309603678