Subject: Re: [websec] WGLC feedback for X-Frame-Options

From: =JeffH <[email-masked]>
Date: Thu, 08 Nov 2012 08:46:40 -0800

thanks to Dave and Tobias for writing up this spec.

+1 to other folks' comments on this draft.

I suggest an explicit statement such as..

   The purpose of this specification is to document existing practice.

..should appear in the abstract and the intoduction.

It appears to me that there's various editorial roughness even beyond the prior 
comments that will be caught by the RFC editor (given my recent experience); 
the document would benefit from a thorough editorial pass.

one item I just noticed that's not mentioned by others it seems is that they 
header field name in S4.1.  Registration Template is..

   Header field name: X-Frame-Option

..yet it is referred to as "X-Frame-Options" in the rest of the spec (note the 
final "s" in the latter, but not in the former). It appears from..

http://blogs.msdn.com/b/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx

..that the latter is the correct form that ought to be registered with IANA ?

I wonder if also a note will be necessary to explain the use of the "X-" prefix 
in light of...

6648 Deprecating the "X-" Prefix and Similar Constructs in Application
      Protocols. P. Saint-Andre, D. Crocker, M. Nottingham. June 2012.

HTH,

=JeffH

---

From: Barry Leiba <[email-masked]>
Date: Thu, 8 Nov 2012 14:22:21 -0500

> ..should appear in the abstract and the intoduction.
...
> I wonder if also a note will be necessary to explain the use of the "X-"
> prefix in light of...
>

These are, of course, related, and one statement can cover both.  I
can pretty much guarantee you'll get DISCUSSes from the IESG if you
don't do it.

Barry, as AD

---

From: Tobias Gondrom <[email-masked]>
Date: Thu, 08 Nov 2012 14:28:43 -0500

> can pretty much guarantee you'll get DISCUSSes from the IESG if you

Thank you Jeff for reminding me. Forgot to include them.
Well, as we already have PSA's RFC on that (which btw. inspired XFO, 
both (comment and reference) have been added to the text of working copy 
(released in next version after this week).

>
> Barry, as AD
> _______________________________________________
> websec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/websec

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 08 Nov 2012 14:31:20 -0500

On 11/8/12 2:28 PM, Tobias Gondrom wrote:
>>> I wonder if also a note will be necessary to explain the use of
>>> the "X-" prefix in light of...
>>> 
>>> 6648 Deprecating the "X-" Prefix and Similar Constructs in
>>> Application Protocols. P. Saint-Andre, D. Crocker, M.
>>> Nottingham. June 2012.
>> These are, of course, related, and one statement can cover both.
>> I can pretty much guarantee you'll get DISCUSSes from the IESG if
>> you don't do it.
> 
> Thank you Jeff for reminding me. Forgot to include them. Well, as
> we already have PSA's RFC on that (which btw. inspired XFO, both
> (comment and reference) have been added to the text of working
> copy (released in next version after this week).

I'm happy to look at that text when it is released.

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/