Hi all,
sorry for the late answer, a flu and some other duties kept me from
answering so far.
I agree with Thomas, Adam and David, so please go ahead with the
webappsecwg charter.
The current plan for #3 is to be adopted in websec (as http headers
should be done in IETF) and proceed within a few months to RFC. (main
idea is to progress the adopted X-Frame-Options to standard and enhance
where necessary).
A conflict with current CSP would be bad, but as Adam said, I agree that
it might be kept outside of CSP and progress normally in websec.
Kind regards, Tobias
On 12/07/11 20:07, Thomas Roessler wrote:
So, looking at this thread, here's what I suggest for the webappsecwg charter: We keep
the deliverable in there, but make it very clear that the group should liaise
particularly closely with websec "and other IETF work around framing policy"
(or some such), explicitly to avoid conflicting or competing specifications.
That way, if the vision of complementary specs that Brad describes
materializes, we have the necessary charter coverage, but we're very clear that
other work is going on and should be respected.
If that's ok with everybody, I'll make the tweak before we send this to the
membership.
--
Thomas Roessler, W3C<t...@w3.org> (@roessler)
On Jul 8, 2011, at 01:07 , David Ross wrote:
#3 is a narrowly scoped effort to standardize something that works pretty well
today in practice (X-FRAME-OPTIONS). A conflict with CSP would be bad, but per
Adam it seems like overlap is looking less likely. So proceeding down the
current path on #3 sounds good to me.
David Ross
dr...@microsoft.com
-----Original Message-----
From: Adam Barth [mailto:w...@adambarth.com]
Sent: Thursday, July 07, 2011 3:24 PM
To: Thomas Roessler
Cc: Tobias Gondrom; Arthur Barstow; Brad Hill; Eric Rescorla; Alexey Melnikov;
David Ross; Anne van Kesteren; Adrian Bateman; Brandon Sterne; Charles
McCathieNevile; Maciej Stachowiak; Peter Saint-Andre; Michael(tm) Smith; Mark
Nottingham; Jeff Hodges; public-web-secur...@w3.org; public-webapps@w3.org;
web...@ietf.org
Subject: Re: Frame embedding: One problem, three possible specs?
My sense from talking with folks is that there isn't a lot of enthusiasm for
supporting this use case in CSP at the present time.
We're trying to concentrate on a core set of directives for the first
iteration. If it helps reduce complexity, you might consider dropping option
(1) for the time being.
Adam
On Thu, Jul 7, 2011 at 2:11 PM, Thomas Roessler<t...@w3.org> wrote:
(Warning, this is cross-posted widely. One of the lists is the IETF
websec mailing list, to which the IETF NOTE WELL applies:
http://www.ietf.org/about/note-well.html)
Folks,
there appear to be at least three possible specifications addressing this
space, with similar but different designs:
1. A proposed deliverable in the WebAppSec group to take up on X-Frame-Options
and express those in CSP:
http://www.w3.org/2011/07/appsecwg-charter.html
(We expect that this charter might go to the W3C AC for review as soon
as next week.)
2. The "From-Origin" draft (aka "Cross-Origin Resource Embedding Exclusion")
currently considered for publication as an FPWD in the Webapps WG:
http://lists.w3.org/Archives/Public/public-webapps/2011JulSep/0088.htm
l
This draft mentions integration into CSP as a possible path forward.
3. draft-gondrom-frame-options, an individual I-D mentioned to websec:
https://datatracker.ietf.org/doc/draft-gondrom-frame-options/
http://www.ietf.org/mail-archive/web/websec/current/msg00388.html
How do we go about it? One path forward might be to just proceed as currently
planned and coordinate when webappsec starts working.
Another path forward might be to see whether we can agree now on what forum to
take these things forward in (and what the coordination dance might look like).
Thoughts welcome.
Regards,
--
Thomas Roessler, W3C<t...@w3.org> (@roessler)
