Subject: [websec] draft-ietf-websec-key-pinning-20 POST report format

From: Julian Reschke <[email-masked]>
Date: Tue, 26 Aug 2014 12:18:49 +0200

Hi there,

this is about 
<http://tools.ietf.org/html/draft-ietf-websec-key-pinning-20#section-3>.

1) I believe it would be good if the example actually showed the full 
POST request so that it contains the media type.

2) Speaking of which: I assume the media type is supposed to be 
application/json?

Also, this essentially introduces a mechanism by which the UA will 
automatically send an unsafe HTTP request (POST) to a server which might 
have a different origin than the server triggering this. Are we sure 
that this doesn't introduce a new exploit? Maybe it would be better to 
at least use a non-generic media type instead?

Best regards, Julian