Subject: [apps-discuss] Webfinger Section 6 suggested re-wording

From: Joe Gregorio <[email-masked]>
Date: Tue, 27 Nov 2012 23:23:38 -0500

Currently Section 6 reads:

   WebFinger is most useful when it is accessible without restrictions
   on the Internet, including web browsers.  Therefore, WebFinger
   servers MUST support Cross-Origin Resource Sharing (CORS) [10] by
   including the following HTTP header in responses:

      Access-Control-Allow-Origin: *

   Enterprise WebFinger servers that wish to restrict access to
   information from external entities SHOULD use a more restrictive
   Access-Control-Allow-Origin header.

The wording is contradictory since it declares the server MUST send
A-C-A-O: *, but
then says the server SHOULD return another value in the 'Enterprise' case, but
never explains what 'Enterprise' means. My suggested re-wording is:

  WebFinger is most useful when the service is most widely accessible, including
  from within web browsers. The current best practice is to make resources
  available to browsers through Cross-Origin Resource Sharing (CORS)
[10], and servers
  SHOULD include the Access-Control-Allow-Origin HTTP header in
responses. Servers SHOULD
  support the least restrictive setting by allowing any domain access
to the WebFinger resources:

      Access-Control-Allow-Origin: *

   There are cases where defaulting to the least restrictive settting
is not appropriate, for
   example a WebFinger server on an intranet that provides company
sensitive information
   should not allow CORS requests from any domain, as that could allow
leaking of that
   senstive information. WebFinger servers that wish to restrict access to
   information from external entities SHOULD use a more restrictive
   Access-Control-Allow-Origin header.

   -joe

--
Joe Gregorio        http://bitworking.org

---

From: "Paul E. Jones" <[email-masked]>
Date: Wed, 28 Nov 2012 03:27:55 -0500

Joe,

I made some changes and prepared the text before I saw this message.

Have a look at the -05 draft and see if you think I need further changes.

Paul

> -----Original Message-----
> From: [email-masked] [mailto:apps-discuss-
> [email-masked]] On Behalf Of Joe Gregorio
> Sent: Tuesday, November 27, 2012 11:24 PM
> To: [email-masked]; [email-masked]
> Subject: [apps-discuss] Webfinger Section 6 suggested re-wording
> 
> then says the server SHOULD return another value in the 'Enterprise'
> case, but never explains what 'Enterprise' means. My suggested re-
> wording is:
> 
> 
>   support the least restrictive setting by allowing any domain access to
> the WebFinger resources:
> 
>    There are cases where defaulting to the least restrictive settting is
> not appropriate, for
> _______________________________________________
> apps-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/apps-discuss

---

From: Joe Gregorio <[email-masked]>
Date: Wed, 28 Nov 2012 08:41:29 -0500

I like the change you made, but that change doesn't address the issues
I have with
the rest of the text. My suggested rewording:

WebFinger resources may not be accessible from a web browser due to
"Same-Origin" policies. The current best practice is to make resources
available to browsers through Cross-Origin Resource Sharing (CORS)
[10], and servers SHOULD include the Access-Control-Allow-Origin HTTP
header in responses. Servers SHOULD support the least restrictive setting
by allowing any domain access to the WebFinger resources:

There are cases where defaulting to the least restrictive settting
is not appropriate, for example a WebFinger server on an intranet
that provides company sensitive information should not allow CORS
requests from any domain, as that could allow leaking of that
senstive information. WebFinger servers that wish to restrict access to
information from external entities SHOULD use a more restrictive
Access-Control-Allow-Origin header.

---

From: Brad Fitzpatrick <[email-masked]>
Date: Tue, 27 Nov 2012 20:34:29 -0800

Or what if they MUST set the "Access-Control-Allow-Origin" header but it
SHOULD be set to "*"?

(If people want the MUST in there somewhere....)

I don't care either way.

---

From: "Paul E. Jones" <[email-masked]>
Date: Thu, 29 Nov 2012 00:11:09 -0500

Joe,

Thanks for your suggested wording.  I’ve inserted that (with minor editorial tweaks) into that section.

I did make one change along the lines of what Brad mentioned.  The concern I think people will have (and I’ve heard this from several) is that they wish to require servers to support CORS.  Servers can use a very restrictive header value, but the CORS header MUST be present.

So, I use this language:

“...servers MUST include the Access-Control-Allow-Origin HTTP header in responses.  Servers SHOULD support the least...”

Paul

From: [email-masked] [mailto:[email-masked]] On Behalf Of Brad Fitzpatrick
Sent: Tuesday, November 27, 2012 11:34 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [apps-discuss] Webfinger Section 6 suggested re-wording

Or what if they MUST set the "Access-Control-Allow-Origin" header but it SHOULD be set to "*"?

I don't care either way.

   -joe

---

From: Joe Gregorio <[email-masked]>
Date: Thu, 29 Nov 2012 09:14:00 -0500

Sounds good to me, thanks!

  -joe

On Thu, Nov 29, 2012 at 12:11 AM, Paul E. Jones <[email-masked]> wrote:
> I did make one change along the lines of what Brad mentioned.  The concern I
> think people will have (and I’ve heard this from several) is that they wish
> to require servers to support CORS.  Servers can use a very restrictive
> header value, but the CORS header MUST be present.
>
>
>
> So, I use this language:
>
> “...servers MUST include the Access-Control-Allow-Origin HTTP header in
> responses.  Servers SHOULD support the least...”
>
>
>
> Paul
>
>
>