Subject: Re: [websec] draft-ietf-websec-origin-02

From: Adam Barth <[email-masked]>
Date: Sun, 3 Jul 2011 02:44:36 -0700

On Sat, Jun 25, 2011 at 11:17 AM, Blanc Gregory <[email-masked]> wrote:
> Hello,
>
> please find below a few spotted typos and comments.
>
> abstract:
> "underlie" instead of "underly"
> "concept of origin" instead of "origin concept"

Fixed.

> page 5:
> "an idna-canonicalized" instead of "a idna-canonicalized"

Fixed.

> page 9:
> 3.4.1
> "content retrieved from one URI" instead of "content retrieve from one URI"

Fixed.

> page 10:
> 3.4.2
> "permitted to use" instead of "permitted use"

Fixed.

> page 13:
> 5.
> "Two origins" instead of "To origins"

Fixed.

> page 16:
> 7.2
> "For example, consider a user agent that executes scripts on behalf of
> origins.  If one of those scripts causes the user agent to issue an
> HTTP request, the user agent might wish to use the Origin header to
> inform the server that the request was issued by the script".
> Since the Origin header is a list of serialized origins, we can
> assume this contains the origin that issued the request but not
> the specific script as the sentence above indicates.
> This is somehow tackled in page 19, section 8.3.

I've clarified that the Origin header indicates the security context
in which the script was executing, not necessarily the origin of the
script code itself.

> "In some cases, a number of origins contribute to causing the user
> agents to issue an HTTP request.  In those cases, the user agent can
> list all the origins in the Origin header.  For example, if the HTTP
> request was initially issued by one origin but then later redirected
> by another origin, the user agent might wish to inform the server
> that two origins were involved in causing the user agent to issue the
> request".
> Does the sentence above only refer to the case of redirection as
> evidenced by the example or does the author implies other cases?

There are other cases as well.  For example, imagine a call stack that
involves a bunch of origins.  If you were interested in stack
inspection, you might list all those origins in the Origin header.

> To the best of my knowledge, I cannot think of any other case?
> Maybe I should think more about it. At least, cases implied here
> are only sequential and never concurrent, aren't they?

I'm not sure there are any other concrete examples today, but there
could well be in the future.  The point is just to have the
flexibility in case we need it in the future.  Generally speaking,
there are many causes for any particular event, so this
syntax+semantics gives us the flexibility to handle that case, if we
need it.

Thanks!
Adam

> 06/25/11 に、Adam Barth  <[email-masked]> さんは書きました:
>
>> I've posted an updated version of the origin draft:
>>
>> http://www.ietf.org/id/draft-ietf-websec-origin-02.txt
>>
>> The new version includes Security Considerations, IANA Considerations,
>> and a completed references section.  Feedback on the new Security
>> Considerations section would be much appreciated.
>>
>> I also removed the (stub) Privacy Considerations section.  If there's
>> something you think should be discussed there, let me know.
>>
>> Thanks,
>> Adam
>> _______________________________________________
>> websec mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/websec
>
>

---

From: Adam Barth <[email-masked]>
Date: Sun, 3 Jul 2011 02:46:47 -0700

On Wed, Jun 29, 2011 at 6:59 AM, Robert Buchholz
<[email-masked]> wrote:
> Besides the typos noted by Gregory, page 20 has:
>  "This practice is incompatible with URIs schemes that"
> which should probably be
>  "This practice is incompatible with URI schemes that"

Fixed.

Adam

---

From: Adam Barth <[email-masked]>
Date: Sun, 3 Jul 2011 02:52:55 -0700

On Sun, Jun 26, 2011 at 2:57 PM, Chris Weber <[email-masked]> wrote:
> A couple of questions:
>
> 1) Do you have a reference to the "chrome-extension URI scheme"?  I was just
> trying to figure out what it was.
>
> 2) In section 6.1 where it says:
>
> "4.  Apply the IDNA ToUnicode algorithm [RFC5891] to each component of
>        the host part of the origin triple"
>
> Should the reference be to Section 4.2 "ToUnicode" of RFC3490
> http://tools.ietf.org/html/rfc3490#section-4.2, or Section 5.2 "Conversion
> to Unicode" of RFC 5891 http://tools.ietf.org/html/rfc5891#section-5.2?

I've made this more explicit (and added a reference to Section 10.1).

Adam

> On 6/24/2011 1:59 PM, Adam Barth wrote:
>

---

From: Adam Barth <[email-masked]>
Date: Sun, 3 Jul 2011 02:54:10 -0700

On Thu, Jun 30, 2011 at 4:30 PM, Chris Weber <[email-masked]> wrote:
> On 6/30/2011 3:51 PM, Adam Barth wrote:
>> Actually, I misspoke.  The idna-canonicalization is a defined
>> algorithm in the spec (which eventually references 10.1).  I need to
>> go through and make sure all the reference point to the right things.
>>
>> Adam
>
> Oh duh, I feel silly.  Editorial nit - maybe a minor change to make the
> terms (or tense) match would help.  Keeping with section 2.3's defined term
> "idna-canonicalized" then the sentence in section 4 step 5 would read:
>
>  "Let uri-host be the idna-canonicalized form of the host component of the
> URI."

Fixed.

Adam

---

From: Adam Barth <[email-masked]>
Date: Fri, 29 Jul 2011 11:35:20 -0700

On Sat, Jun 25, 2011 at 3:48 AM, Julian Reschke <[email-masked]> wrote:
> On 2011-06-24 22:59, Adam Barth wrote:
>>
>> ...
>> ...
> Editorial nits: the references section should cite Internet Drafts as such;
> see
>
>
> http://xml.resource.org/public/rfc/bibxml3/reference.I-D.draft-ietf-hybi-thewebsocketprotocol-09.xml
>
> and
>
>
> http://xml.resource.org/public/rfc/bibxml3/reference.I-D.draft-ietf-websec-mime-sniff-03.xml
>
> (note you may want to short the anchors)
>
> For the W3C references I recommend the format in
> <http://greenbytes.de/tech/webdav/rfc2629xslt/w3c-references.html>:
>
> <reference anchor='WD-cors-20100727'
>           target='http://www.w3.org/TR/2010/WD-cors-20100727/'>
>  <front>
>    <title>Cross-Origin Resource Sharing</title>
>    <author fullname='Anne van Kesteren' surname='van Kesteren'
> initials='A.'/>
>    <date year='2010' month='July' day='27'/>
>  </front>
>  <seriesInfo name='W3C Working Draft' value='WD-cors-20100727'/>
>  <annotation>
>    Latest version available at
>    <eref target='http://www.w3.org/TR/cors/'/>.
>  </annotation>
> </reference>
>
> <reference anchor='WD-html5-20110525'
>           target='http://www.w3.org/TR/2011/WD-html5-20110525/'>
>  <front>
>    <title>HTML5</title>
>    <author fullname='Ian Hickson' surname='Hickson' initials='I.'/>
>    <date year='2011' month='May' day='25'/>
>  </front>
>  <seriesInfo name='W3C Working Draft' value='WD-html5-20110525'/>
>  <annotation>
>    Latest version available at
>    <eref target='http://www.w3.org/TR/html5/'/>.
>  </annotation>
> </reference>

Done.

Adam