Subject: [core] draft-ietf-core-coap-06 Cache-Control

From: Cullen Jennings <[email-masked]>
Date: Wed, 4 May 2011 20:49:05 -0600

I worry about the privacy implication of CoAP not having the equivalent of HTTP "Cache-Control : private". In a perfect rest world, a GET to a given URL would return same result regardless of who request it but practically speaking, that's ship sailed long ago and different results get returned depending on who asked. There is lots of good use cases for this - particularly when we start talking about privacy. Just saying that something can not be cached by using Mac-Age = 0 is seems far too limiting. Clearly many constrained devices would not need to use and "Cache-Control : private " options but it seems like something that caching proxies need to support. 

I suspect someone from the IETF Privacy Directorate might tell us that if we are doing caching of sensitive data, we really need to have some way to limit access to that that is better than "don't do that"

Cullen <in my role as an individual contributor>