Re: Two questions about violation reports

On Thu, Feb 2, 2012 at 2:26 PM, Hill, Brad <bhill@paypal-inc.com> wrote:
>> The |request| field in the violation report is defined as the "HTTP request
>> line of the protected resource whose policy was violated including method,
>> URI and HTTP version". �However, this seems like an odd layering violation.
>> For example, why does the server care about the HTTP version? �It seems like
>> a more useful field would just be the URI of the protected document.
>>
>> B) Should we remove the |request| field in place of a |document-uri| field
>> containing the document's URI? �(Recommendation: Yes)
>
> [Hill, Brad]
>
> 1) I think we need clear language about URI fragments in this case. �They are not part of the HTTP request, but they are part of the URI as seen by the User-Agent.
>
> I think the current state of discussion is that the fragment may be desirable as part of violation reports (as it is a frequent carrier for DOMXSS payloads) but should be an OPTIONAL report feature. (and therefore version 1.1) �For version 1.0, the existence of architectures such as web-keys (http://waterken.sourceforge.net/web-key/) that depend on the existing semantics of fragments and their (non-)transmission on the network, we probably should exclude them.

Yeah, that's a good point.  We should probably strip out the fragment
from all the URIs in the reports (e.g., including the blocked-uri).

Adam

Received on Thursday, 2 February 2012 22:52:10 UTC