Subject: Re: [websec] I-D Action: draft-ietf-websec-origin-05.txt

From: Adam Barth <[email-masked]>
Date: Sun, 2 Oct 2011 15:14:06 -0700

On Fri, Sep 23, 2011 at 12:29 AM, Julian Reschke <[email-masked]> wrote:
> On 2011-09-23 00:33, [email-masked] wrote:
>>
>> A New Internet-Draft is available from the on-line Internet-Drafts
>> directories. This draft is a work item of the Web Security Working Group of
>> the IETF.
>> ...
>
> Nits...:
>
>>   The OWS (optional whitespace) rule is used where zero or more linear
>>   whitespace characters MAY appear:
>>
>>   OWS            = *( [ obs-fold ] WSP )
>>                    ; "optional" whitespace
>>   obs-fold       = CRLF
>
> We changed the definition of OWS nin HTTPbis:
> <http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p1-messaging-latest.html#basic.rules>

Updated.

>>   1.  If the URI does not use a hierarchical element as a naming
>>       authority (see [RFC3986], Section 3.2), or if the URI is not an
>>       absolute URI, then generate a fresh globally unique identifier
>>       and return that value.
>>
>>       1.  NOTE: Running this algorithm multiple times for the same URI
>>           can produce different values each time.  Typically, user
>>           agents compute the origin of, for example, an HTML document
>>           once and use that origin for subsequent security checks
>>           rather than recomputing the origin for each security check.
>
> It seems the NOTE shouldn't be in a numbered list (same for item 4).

Fixed.

>> 7.1. Syntax
>>
>>
>>   The Origin header field has the following syntax:
>>
>>
>>  origin              = "Origin:" OWS origin-list-or-null OWS
>>  origin-list-or-null = "null" / origin-list
>>  origin-list         = serialized-origin *( SP serialized-origin )
>>  serialized-origin   = scheme "://" host [ ":" port ]
>>                     ; <scheme>, <host>, <port> productions from RFC3986
>
> a) Reformat do it doesn't need to be outdented

Done.

> b) "null" in ABNF means case-insensitive; consider replacing with octet
> sequence and putting the literal "null" into a comment.

Done.

> References: may need updates, such as WEBSOCKETS. Also consider sorting them
> (xml2rfc sortrefs PI).

I've updated WEBSOCKETS.  It will probably need to be updated again.

Thanks!
Adam

---

From: "Martin J. Dürst" <[email-masked]>
Date: Mon, 03 Oct 2011 15:26:09 +0900

On 2011/10/03 7:14, Adam Barth wrote:
> On Fri, Sep 23, 2011 at 12:29 AM, Julian Reschke<[email-masked]>  wrote:

> I've updated WEBSOCKETS.  It will probably need to be updated again.

My policy in cases like this is: Whenever I update a draft, I check the 
references and update them if needed.

However, the RFC editor is very good at getting these things right, so 
there's no need to produce a new draft just because another one as 
increased its number.

Regards,   Martin.

---

From: Adam Barth <[email-masked]>
Date: Sun, 2 Oct 2011 23:33:31 -0700

On Sun, Oct 2, 2011 at 11:26 PM, "Martin J. Dürst"
<[email-masked]> wrote:
> there's no need to produce a new draft just because another one as increased
> its number.

Thanks.  That's useful to know.

Adam

---

From: Julian Reschke <[email-masked]>
Date: Mon, 03 Oct 2011 10:19:10 +0200

> there's no need to produce a new draft just because another one as

Indeed. And if you use xml2rfc, those checks can be automated: 
<http://greenbytes.de/tech/webdav/rfc2629xslt/rfc2629xslt.html#checking-references>

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Wed, 05 Oct 2011 16:41:29 +0200

> It seems the NOTE shouldn't be in a numbered list (same for item 4).

Draft -06 has another instance of this nit :-)

> sequence and putting the literal "null" into a comment.

You now have:

   origin-list-or-null = %x6E %x75 %x6C %x6C / origin-list

You can make that

   origin-list-or-null = %x6E.75.6C.6C / origin-list

and make it more readable by saying:

   null                = %x6E.75.6C.6C ; "null", case-sensitive
   origin-list-or-null = null / origin-list

Best regards, Julian