Subject: Re: "Origin Header for CSRF Mitigation" to IETF or W3C?

From: Dan Connolly <[email-masked]>
Date: Tue, 16 Dec 2008 10:56:43 -0600

On Tue, 2008-11-25 at 09:12 -0800, Lisa Dusseault wrote:
> Hi Dan,
> 
> I pinged a few of these guys (Adam and Collin) a while back about
> their work, just a general investigation, and didn't get much of an
> answer.  I wondered if they were looking at the HTML5 work, as a
> matter of fact :)
>
> The HTTP WG is of course the perfect place to get an expert opinion
> and develop into a standard, and I can also bring in comsec experts
> when that's appropriate.

I understand the scope of the current HTTP WG to be fairly narrow;
do you see that WG taking on Origin? Or a new WG? Or something else?

> As for a personal opinion, I can't see a major flaw so far, but I can
> see that this is missing the perspective of rich clients using HTTP
> (WebDAV and Atom clients, for starters).
> 
> lisa
> 
> On Tue, Nov 25, 2008 at 7:48 AM, Dan Connolly <[email-masked]> wrote:
>         I've been asked about standardization of this mechanism...
>         
>          "Origin Header for CSRF Mitigation"
>          http://crypto.stanford.edu/websec/specs/origin-header/
>         
>         especially whether this fits better at W3C or IETF.
>         
>         Have IETF area directors been approached? formed an opinion?

-- 
Dan Connolly, W3C http://www.w3.org/People/Connolly/
gpg D3C2 887B 0F92 6005 C541  0875 0F91 96DE 6E52 C29E
office: tel:+1-617-395-0241
mobile: tel:+1-816-616-6576
mobile: mailto:[email-masked]