From ietf-message-headers-bounces@ietf.org Mon Oct 01 06:10:26 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IcIEJ-0002TX-28; Mon, 01 Oct 2007 06:10:23 -0400 Received: from ietf-message-headers by megatron.ietf.org with local (Exim 4.43) id 1IcIEI-0002TR-1X for ietf-message-headers-confirm+ok@megatron.ietf.org; Mon, 01 Oct 2007 06:10:22 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IcIEH-0002Q7-O7 for ietf-message-headers@lists.ietf.org; Mon, 01 Oct 2007 06:10:21 -0400 Received: from sam.opera.com ([213.236.208.81]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IcIE8-0004lL-Cu for ietf-message-headers@lists.ietf.org; Mon, 01 Oct 2007 06:10:18 -0400 Received: from annevk-t60.oslo.opera.com (c5144430c.cable.wanadoo.nl [81.68.67.12]) (authenticated bits=0) by sam.opera.com (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id l91A9oUJ008511 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Mon, 1 Oct 2007 10:09:51 GMT Date: Mon, 01 Oct 2007 12:09:57 +0200 To: ietf-message-headers@lists.ietf.org Subject: Re: [Ietf-message-headers] Re: HTTP header registration question From: "Anne van Kesteren" Organization: Opera Software ASA Content-Type: text/plain; format=flowed; delsp=yes; charset=utf-8 MIME-Version: 1.0 References: <6.0.0.20.2.20070928194301.0383ab30@localhost> <6.0.0.20.2.20070929192836.0bb84270@localhost> Content-Transfer-Encoding: 7bit Message-ID: In-Reply-To: <6.0.0.20.2.20070929192836.0bb84270@localhost> User-Agent: Opera Mail/9.21 (Linux) X-Virus-Scanned: ClamAV 0.91.1/4444/Mon Oct 1 07:57:17 2007 on sam.opera.com X-Virus-Status: Clean X-Spam-Score: 0.0 (/) X-Scan-Signature: 7655788c23eb79e336f5f8ba8bce7906 Cc: X-BeenThere: ietf-message-headers@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Discussion list for header fields used in Internet messaging applications." List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ietf-message-headers-bounces@ietf.org On Sat, 29 Sep 2007 12:31:54 +0200, Martin Duerst wrote: > At 18:58 07/09/29, Anne van Kesteren wrote: > I suggest that you look at the IDNA RFCs if you want to get a definition > of a label including non-ASCII characters. IDNA definitely deals with > individual labels, because that's where punicode and the xn-- prefix > and all that stuff happen. Ah, it seems RFC 3490 defines "internationalized domain name" which can replace "subdomain" above. "internationalized label" can replace "label". Not sure why I didn't use those from the start. However, for HTTP it seems the ToASCII variant should be required (not just allowed) as HTTP doesn't do Unicode. Thanks. Also thanks to Frank Ellerman for pointing out the limitation of HTTP that has escaped me (and the rest of the people reviewing; I begin to wonder how many there are...). -- Anne van Kesteren _______________________________________________ Ietf-message-headers mailing list Ietf-message-headers@ietf.org https://www1.ietf.org/mailman/listinfo/ietf-message-headers From ietf-message-headers-bounces@ietf.org Thu Oct 04 05:32:36 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IdN49-0003Zx-LM; Thu, 04 Oct 2007 05:32:21 -0400 Received: from ietf-message-headers by megatron.ietf.org with local (Exim 4.43) id 1IdN48-0003Zf-Ls for ietf-message-headers-confirm+ok@megatron.ietf.org; Thu, 04 Oct 2007 05:32:20 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IdN48-0003Uj-37 for ietf-message-headers@lists.ietf.org; Thu, 04 Oct 2007 05:32:20 -0400 Received: from sam.opera.com ([213.236.208.81]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IdN3x-0007jN-NX for ietf-message-headers@lists.ietf.org; Thu, 04 Oct 2007 05:32:16 -0400 Received: from annevk-t60.oslo.opera.com (ip565a461c.direct-adsl.nl [86.90.70.28] (may be forged)) (authenticated bits=0) by sam.opera.com (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id l949VjBt022333 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Thu, 4 Oct 2007 09:31:46 GMT Date: Thu, 04 Oct 2007 11:31:53 +0200 To: ietf-message-headers@lists.ietf.org From: "Anne van Kesteren" Organization: Opera Software ASA Content-Type: text/plain; format=flowed; delsp=yes; charset=utf-8 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Message-ID: User-Agent: Opera Mail/9.21 (Linux) X-Virus-Scanned: ClamAV 0.91.1/4469/Thu Oct 4 06:56:38 2007 on sam.opera.com X-Virus-Status: Clean X-Spam-Score: 0.0 (/) X-Scan-Signature: 7a6398bf8aaeabc7a7bb696b6b0a2aad Cc: Subject: [Ietf-message-headers] If-Method-Allowed renamed to Method-Check X-BeenThere: ietf-message-headers@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Discussion list for header fields used in Internet messaging applications." List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ietf-message-headers-bounces@ietf.org Hi, Because If-Method-Allowed didn't share the semantics of other If-* headers it seemed better to rename it. Should the review period be extended by another two weeks for this header? Kind regards, -- Anne van Kesteren _______________________________________________ Ietf-message-headers mailing list Ietf-message-headers@ietf.org https://www1.ietf.org/mailman/listinfo/ietf-message-headers From ietf-message-headers-bounces@ietf.org Tue Oct 09 18:02:23 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IfN9S-0002GP-GJ; Tue, 09 Oct 2007 18:02:06 -0400 Received: from ietf-message-headers by megatron.ietf.org with local (Exim 4.43) id 1IfN9Q-0002EU-Up for ietf-message-headers-confirm+ok@megatron.ietf.org; Tue, 09 Oct 2007 18:02:04 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IfN9Q-0002DM-Jy for ietf-message-headers@lists.ietf.org; Tue, 09 Oct 2007 18:02:04 -0400 Received: from mail.songbird.com ([208.184.79.10]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IfN9J-0005v3-6u for ietf-message-headers@lists.ietf.org; Tue, 09 Oct 2007 18:02:04 -0400 Received: from [127.0.0.1] (mail.songbird.com [208.184.79.10]) by mail.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l99M1Rh6004149; Tue, 9 Oct 2007 15:01:33 -0700 Message-ID: <470BFA49.2070605@ninebynine.org> Date: Tue, 09 Oct 2007 23:01:45 +0100 From: Graham Klyne User-Agent: Thunderbird 2.0.0.6 (Windows/20070728) MIME-Version: 1.0 To: Anne van Kesteren Subject: Re: [Ietf-message-headers] HTTP header registration question References: In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 21c69d3cfc2dd19218717dbe1d974352 Cc: ietf-message-headers@lists.ietf.org X-BeenThere: ietf-message-headers@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Discussion list for header fields used in Internet messaging applications." List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ietf-message-headers-bounces@ietf.org Anne van Kesteren wrote: > For a W3C specification "Enabling Read Access for Web Resources" the W3C > WAF WG would like to register three HTTP headers: Access-Control, > If-Method-Allowed, and Referer-Root (sic). Can I do that as attached or > is it preferable to have three separate templates? Also, does the > specification itself need to include anything that points back to the > header registry, does it need to include the template, etc.? This did > not became clear from reading RFC 3864. Thanks for the information! My comments concern procedural matters - I make no judgement here about the technical content of the proposal... The registration would probably have to be provisional until such time as the specification documents achieve some kind of standard-equivalent status (e.g. W3C REC). The status information is generally "provisional" for headers in the provisional registry. If this is W3C WG activity for which there is general consensus on the direction if not the final details, then I's suggest that provisional registration should be progressed sooner rather than later (including a note of the venue for ongoing development of the specification). Three separate templates may be preferable - they will lead to separate entries in the registry. With reference to other discussion, in which you said: "the other two are both mentioned and it's defined what they are to contain. (They are request headers.) Maybe they should have syntax definitions as well just to make it complete." ... I think it may help if: (a) they had syntax definitions (or reference to some existing definition), and (b) if it's not obvious, that there be some indication to where in the document the headers are defined (section number of suchlike). The standard of definition required will be higher for permanent registration. #g -- (Although I'm currently a designated reviewer for registrations, my comments here are personal, and carry no formal import.) -- Graham Klyne For email: http://www.ninebynine.org/#Contact _______________________________________________ Ietf-message-headers mailing list Ietf-message-headers@ietf.org https://www1.ietf.org/mailman/listinfo/ietf-message-headers From ietf-message-headers-bounces@ietf.org Wed Oct 10 13:05:22 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ifezh-0005YX-Q0; Wed, 10 Oct 2007 13:05:13 -0400 Received: from ietf-message-headers by megatron.ietf.org with local (Exim 4.43) id 1Ifezg-0005Up-9A for ietf-message-headers-confirm+ok@megatron.ietf.org; Wed, 10 Oct 2007 13:05:12 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1Ifezf-0005Ug-Vu for ietf-message-headers@lists.ietf.org; Wed, 10 Oct 2007 13:05:11 -0400 Received: from sam.opera.com ([213.236.208.81]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IfezZ-0000aG-KH for ietf-message-headers@lists.ietf.org; Wed, 10 Oct 2007 13:05:11 -0400 Received: from annevk-t60.oslo.opera.com (c5144430c.cable.wanadoo.nl [81.68.67.12]) (authenticated bits=0) by sam.opera.com (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id l9AH4pHD026567 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Wed, 10 Oct 2007 17:04:52 GMT Date: Wed, 10 Oct 2007 19:05:05 +0200 To: "Graham Klyne" Subject: Re: [Ietf-message-headers] HTTP header registration question From: "Anne van Kesteren" Organization: Opera Software ASA Content-Type: text/plain; format=flowed; delsp=yes; charset=utf-8 MIME-Version: 1.0 References: <470BFA49.2070605@ninebynine.org> Content-Transfer-Encoding: 7bit Message-ID: In-Reply-To: <470BFA49.2070605@ninebynine.org> User-Agent: Opera Mail/9.21 (Linux) X-Virus-Scanned: ClamAV 0.91.1/4521/Wed Oct 10 07:58:01 2007 on sam.opera.com X-Virus-Status: Clean X-Spam-Score: 0.0 (/) X-Scan-Signature: 82c9bddb247d9ba4471160a9a865a5f3 Cc: ietf-message-headers@lists.ietf.org X-BeenThere: ietf-message-headers@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Discussion list for header fields used in Internet messaging applications." List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ietf-message-headers-bounces@ietf.org On Wed, 10 Oct 2007 00:01:45 +0200, Graham Klyne wrote: > My comments concern procedural matters - I make no judgement here about > the technical content of the proposal... Feel free to make comments on the technical content though! > The registration would probably have to be provisional until such time > as the specification documents achieve some kind of standard-equivalent > status (e.g. W3C REC). The status information is generally > "provisional" for headers in the provisional registry. If this is W3C > WG activity for which there is general consensus on the direction if not > the final details, then I's suggest that provisional registration should > be progressed sooner rather than later > (including a note of the venue for ongoing development of the > specification). Ok. I believe that I can do that tomorrow as the two review weeks have passed then. (I initially e-mailed it on Thu 27 Sep 2007.) > Three separate templates may be preferable - they will lead to separate > entries in the registry. Ok. > With reference to other discussion, in which you said: "the other two > are both mentioned and it's defined what they are to contain. (They are > request headers.) Maybe they should have syntax definitions as well just > to make it complete." > > ... I think it may help if: > (a) they had syntax definitions (or reference to some existing > definition), and > (b) if it's not obvious, that there be some indication to where in the > document the headers are defined (section number of suchlike). http://dev.w3.org/2006/waf/access-control/ now includes the syntax definitions. > The standard of definition required will be higher for permanent > registration. What are the requirements exactly? Thanks a lot by the way! -- Anne van Kesteren _______________________________________________ Ietf-message-headers mailing list Ietf-message-headers@ietf.org https://www1.ietf.org/mailman/listinfo/ietf-message-headers From ietf-message-headers-bounces@ietf.org Fri Oct 12 03:40:24 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IgF7w-0002ug-OX; Fri, 12 Oct 2007 03:40:08 -0400 Received: from ietf-message-headers by megatron.ietf.org with local (Exim 4.43) id 1IgF7v-0002tE-Gb for ietf-message-headers-confirm+ok@megatron.ietf.org; Fri, 12 Oct 2007 03:40:07 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IgF7v-0002t6-74 for ietf-message-headers@lists.ietf.org; Fri, 12 Oct 2007 03:40:07 -0400 Received: from scmailgw2.scop.aoyama.ac.jp ([133.2.251.195]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IgF7o-0008Mb-My for ietf-message-headers@lists.ietf.org; Fri, 12 Oct 2007 03:40:07 -0400 Received: from scmse2.scbb.aoyama.ac.jp (scmse2 [133.2.253.17]) by scmailgw2.scop.aoyama.ac.jp (secret/secret) with SMTP id l9C7dsJG020455 for ; Fri, 12 Oct 2007 16:39:57 +0900 (JST) Received: from (133.2.206.133) by scmse2.scbb.aoyama.ac.jp via smtp id 1b5c_531bda56_7896_11dc_9f77_0014221f2a2d; Fri, 12 Oct 2007 16:39:54 +0900 X-AuthUser: duerst@it.aoyama.ac.jp Received: from Tanzawa.it.aoyama.ac.jp ([133.2.210.1]:35954) by itmail.it.aoyama.ac.jp with [XMail 1.22 ESMTP Server] id for from ; Fri, 12 Oct 2007 16:36:22 +0900 Message-Id: <6.0.0.20.2.20071012095202.07676520@localhost> X-Sender: duerst@localhost X-Mailer: QUALCOMM Windows Eudora Version 6J Date: Fri, 12 Oct 2007 09:57:04 +0900 To: "Anne van Kesteren" , "Graham Klyne" From: Martin Duerst Subject: Re: [Ietf-message-headers] HTTP header registration question In-Reply-To: References: <470BFA49.2070605@ninebynine.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Spam-Score: 1.9 (+) X-Scan-Signature: c3a18ef96977fc9bcc21a621cbf1174b Cc: ietf-message-headers@lists.ietf.org X-BeenThere: ietf-message-headers@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Discussion list for header fields used in Internet messaging applications." List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ietf-message-headers-bounces@ietf.org I have just realized that I haven't seen any security issues for this proposal described or discussed, although I think that there may be quite some security issues connected to phishing, which should be carefully analysed and described. The scenario I'm thinking about is that a phishing site, rather than as currently having to get the passwords from the user to its server, and then from there contact the real server, may be able to list the real server in an Access-Control header and therewith may be able to correspond directly between client and real server, potentially circumventing some security checks that were in place until now (e.g. a plausability check for the IP address of the user,...). Regards, Martin.s At 02:05 07/10/11, Anne van Kesteren wrote: >On Wed, 10 Oct 2007 00:01:45 +0200, Graham Klyne >wrote: >> My comments concern procedural matters - I make no judgement here about >> the technical content of the proposal... > >Feel free to make comments on the technical content though! > > >> The registration would probably have to be provisional until such time >> as the specification documents achieve some kind of standard-equivalent >> status (e.g. W3C REC). The status information is generally >> "provisional" for headers in the provisional registry. If this is W3C >> WG activity for which there is general consensus on the direction if not >> the final details, then I's suggest that provisional registration should >> be progressed sooner rather than later >> (including a note of the venue for ongoing development of the >> specification). > >Ok. I believe that I can do that tomorrow as the two review weeks have >passed then. (I initially e-mailed it on Thu 27 Sep 2007.) > > >> Three separate templates may be preferable - they will lead to separate >> entries in the registry. > >Ok. > > >> With reference to other discussion, in which you said: "the other two >> are both mentioned and it's defined what they are to contain. (They are >> request headers.) Maybe they should have syntax definitions as well just >> to make it complete." >> >> ... I think it may help if: >> (a) they had syntax definitions (or reference to some existing >> definition), and >> (b) if it's not obvious, that there be some indication to where in the >> document the headers are defined (section number of suchlike). > >http://dev.w3.org/2006/waf/access-control/ now includes the syntax >definitions. > > >> The standard of definition required will be higher for permanent >> registration. > >What are the requirements exactly? > > >Thanks a lot by the way! > > >-- >Anne van Kesteren > > > > >_______________________________________________ >Ietf-message-headers mailing list >Ietf-message-headers@ietf.org >https://www1.ietf.org/mailman/listinfo/ietf-message-headers #-#-# Martin J. Du"rst, Assoc. Professor, Aoyama Gakuin University #-#-# http://www.sw.it.aoyama.ac.jp mailto:duerst@it.aoyama.ac.jp _______________________________________________ Ietf-message-headers mailing list Ietf-message-headers@ietf.org https://www1.ietf.org/mailman/listinfo/ietf-message-headers From ietf-message-headers-bounces@ietf.org Fri Oct 12 05:42:09 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IgH1w-0000GA-Gc; Fri, 12 Oct 2007 05:42:04 -0400 Received: from ietf-message-headers by megatron.ietf.org with local (Exim 4.43) id 1IgH1v-00008S-8R for ietf-message-headers-confirm+ok@megatron.ietf.org; Fri, 12 Oct 2007 05:42:03 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IgH1u-0008Q9-UO for ietf-message-headers@lists.ietf.org; Fri, 12 Oct 2007 05:42:02 -0400 Received: from sam.opera.com ([213.236.208.81]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IgH1m-0004Y0-JX for ietf-message-headers@lists.ietf.org; Fri, 12 Oct 2007 05:42:00 -0400 Received: from annevk-t60.oslo.opera.com (c5144430c.cable.wanadoo.nl [81.68.67.12]) (authenticated bits=0) by sam.opera.com (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id l9C9fTfM023222 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Fri, 12 Oct 2007 09:41:31 GMT Date: Fri, 12 Oct 2007 11:41:24 +0200 To: "Martin Duerst" Subject: Re: [Ietf-message-headers] HTTP header registration question From: "Anne van Kesteren" Organization: Opera Software ASA Content-Type: text/plain; format=flowed; delsp=yes; charset=utf-8 MIME-Version: 1.0 References: <470BFA49.2070605@ninebynine.org> <6.0.0.20.2.20071012095202.07676520@localhost> Content-Transfer-Encoding: 7bit Message-ID: In-Reply-To: <6.0.0.20.2.20071012095202.07676520@localhost> User-Agent: Opera Mail/9.21 (Linux) X-Virus-Scanned: ClamAV 0.91.1/4530/Thu Oct 11 20:02:20 2007 on sam.opera.com X-Virus-Status: Clean X-Spam-Score: 0.0 (/) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 Cc: ietf-message-headers@lists.ietf.org X-BeenThere: ietf-message-headers@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Discussion list for header fields used in Internet messaging applications." List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: ietf-message-headers-bounces@ietf.org On Fri, 12 Oct 2007 02:57:04 +0200, Martin Duerst wrote: > I have just realized that I haven't seen any security issues > for this proposal described or discussed, although I think > that there may be quite some security issues connected to > phishing, which should be carefully analysed and described. Actually, security considerations are discussed in http://dev.w3.org/2006/waf/access-control/#security > The scenario I'm thinking about is that a phishing site, > rather than as currently having to get the passwords from > the user to its server, and then from there contact the > real server, may be able to list the real server in > an Access-Control header and therewith may be able to > correspond directly between client and real server, > potentially circumventing some security checks that > were in place until now (e.g. a plausability check > for the IP address of the user,...). How would this work exactly? I don't understand the scenario. -- Anne van Kesteren _______________________________________________ Ietf-message-headers mailing list Ietf-message-headers@ietf.org https://www1.ietf.org/mailman/listinfo/ietf-message-headers