canmove, Confirmed users
1,537
edits
Security/Features: Difference between revisions
Jump to navigation
Jump to search
m
→Origin Header / Sec-From
| Line 49: | Line 49: | ||
Beginning as an [[Security/Origin]] header that aimed to prevent clickjacking as well as CSRF and JSON data theft, this feature has evolved into [[Security/Sec-From]] that will not prevent clickjacking, but can be compatible with various other specifications for similar HTTP request headers. | Beginning as an [[Security/Origin]] header that aimed to prevent clickjacking as well as CSRF and JSON data theft, this feature has evolved into [[Security/Sec-From]] that will not prevent clickjacking, but can be compatible with various other specifications for similar HTTP request headers. | ||
'''Design''': Done (6/18/2009) | |||
''' | |||
Discussion over the behavior and uses of Sec-From has been ongoing, but has merged with the Internet Draft spec proposed by Adam Barth et. al [http://webblaze.cs.berkeley.edu/2009/origin/origin.txt]. | Discussion over the behavior and uses of Sec-From has been ongoing, but has merged with the Internet Draft spec proposed by Adam Barth et. al [http://webblaze.cs.berkeley.edu/2009/origin/origin.txt]. | ||
| Line 56: | Line 55: | ||
Header is also mentioned in HTML 5 [http://www.w3.org/TR/cors/#origin-header]. | Header is also mentioned in HTML 5 [http://www.w3.org/TR/cors/#origin-header]. | ||
''Goals'': | |||
* Provide a reliably present "referrer" that | * Provide a reliably present "referrer" that | ||
** has minimal potential for privacy leak | ** has minimal potential for privacy leak | ||
| Line 63: | Line 62: | ||
* aid in preventing JSON data theft | * aid in preventing JSON data theft | ||
'''Discussion''': In Progress | |||
''' | |||
We've synced up with Adam Barth and settled on a design. He is working with the CORS folks to see if his proposal can be unified with the Origin header they send. | We've synced up with Adam Barth and settled on a design. He is working with the CORS folks to see if his proposal can be unified with the Origin header they send. | ||
| Line 71: | Line 69: | ||
'''Review and Standardization''': In Progress. ETA: ? | |||
'''Prototype''': Not Started. ETA: Q4 2009 | |||
''' | |||
'''Implementation''': Not Started. ETA: ? | |||
''' | |||
== Content Security Policy == | == Content Security Policy == | ||