Subject: "Origin Header for CSRF Mitigation" to IETF or W3C?

From: Dan Connolly <[email-masked]>
Date: Tue, 25 Nov 2008 09:48:16 -0600

I've been asked about standardization of this mechanism...

  "Origin Header for CSRF Mitigation"
  http://crypto.stanford.edu/websec/specs/origin-header/

especially whether this fits better at W3C or IETF.

Have IETF area directors been approached? formed an opinion?

-- 
Dan Connolly, W3C http://www.w3.org/People/Connolly/
gpg D3C2 887B 0F92 6005 C541  0875 0F91 96DE 6E52 C29E
office: tel:+1-617-395-0241
mobile: tel:+1-816-616-6576
mobile: mailto:[email-masked]

---

From: "Lisa Dusseault" <[email-masked]>
Date: Tue, 25 Nov 2008 09:12:43 -0800

Hi Dan,

I pinged a few of these guys (Adam and Collin) a while back about their
work, just a general investigation, and didn't get much of an answer.  I
wondered if they were looking at the HTML5 work, as a matter of fact :)

The HTTP WG is of course the perfect place to get an expert opinion and
develop into a standard, and I can also bring in comsec experts when that's
appropriate.

As for a personal opinion, I can't see a major flaw so far, but I can see
that this is missing the perspective of rich clients using HTTP (WebDAV and
Atom clients, for starters).

lisa

On Tue, Nov 25, 2008 at 7:48 AM, Dan Connolly <[email-masked]> wrote:

> mobile: mailto:[email-masked] <[email-masked]>
>
>