headers
Peter Saint-Andre | 20 Jul 2011 03:44
Favicon

Minutes of the W3C/IETF Coordination Call, July 18, 2011

Minutes of the W3C/IETF Coordination Call, July 18, 2011

Attending: Mark Nottingham, Peter Saint-Andre, Pete Resnick, Sean
Turner, Robert Sparks, Gabriel Montenegro, Alissa Cooper, Thomas
Roessler, Brian Raymor, John Klensin, Adrian Bateman

Regrets: Philippe Le Hagaret, Russ Housley, Stephen Farrell

- Action Item Status (for context, see
<http://www.w3.org/mid/4DFB7645.4030301 <at> stpeter.im>)

ACTION: Pete to send notice of RFC3536bis Last Call to the public list,
mailto:public-ietf-w3c <at> w3.org
-- done; document is approved and heading to RFC editor.

ACTION: liaisons on both sides to gather list of current activities /
interests in prep for discussions in Quebec City.

ACTION: Peter to send reminder for feedback about same-origin to
mailto:public-ietf-w3c <at> w3.org
-- WGLC in WEBSEC WG after IETF 81, will send reminder then

ACTION: Mark to follow up on finding a home for John Kemp's work on HTTP
Security.
-- done.

- IETF HYBI / W3C WebSockets API  [ Gabriel / Thomas ]

   - deflate-stream
     - this is a MAY in the spec right now
(Continue reading)

Permalink | Reply | 0 comments |
headers
Gabriel Montenegro | 26 Jul 2011 00:52
Picon
Favicon

RE: HTTP, websockets, and redirects

Thanks Adam,

By discussed on some  mailing list, do you mean a *W3C* mailing list? Also, allowing the users to handle these
explicitly implies that the API does not mandate dropping the connection. Currently, the API does not
have this flexibility, nor does it allow other uses of non-101 codes, like for authentication. I
understand the potential risks with redirects in browsers, and I thought at one moment we were going to
augment the security considerations with your help for additional guidance. If websec has already
worked on similar language in some draft that we could reuse that would be great, or, similarly, if we could
work with you on that text.

Thanks,

Gabriel

> -----Original Message-----
> From: Adam Barth [mailto:w3c <at> adambarth.com]
> Sent: Sunday, July 24, 2011 13:35
> To: Thomas Roessler
> Cc: public-ietf-w3c <at> w3.org; WebApps WG; Salvatore Loreto; Gabriel
> Montenegro; Art Barstow; François Daoust; Eric Rescorla; Harald Alvestrand;
> Tobias Gondrom
> Subject: Re: HTTP, websockets, and redirects
> 
> This issue was discussed on some mailing list a while back (I forget which).  The
> consensus seemed to be that redirects are the source of a large number of
> security vulnerabilities in HTTP and we'd like users of the WebSocket API to
> handle them explicitly.
> 
> I'm not sure I understand your question regarding WebRTC, but the general
> answer to that class of questions is that WebRTC relies, in large part, on ICE to
(Continue reading)

Permalink | Reply | 2 comments |

Gmane