W3C home > Mailing lists > Public > public-webapps@w3.org > July to September 2011

Frame embedding: One problem, three possible specs?

From: Thomas Roessler <tlr@w3.org>
Date: Thu, 7 Jul 2011 23:11:58 +0200
Message-Id: <DAD1FA49-1355-4769-852C-F47AB8E04682@w3.org>
Cc: Thomas Roessler <tlr@w3.org>, Peter Saint-Andre <stpeter@stpeter.im>, "Michael(tm) Smith" <mike@w3.org>, Mark Nottingham <mnot@mnot.net>, Jeff Hodges <jeff.hodges@paypal-inc.com>, public-web-security@w3.org, public-webapps@w3.org, websec@ietf.org
To: Tobias Gondrom <tobias.gondrom@gondrom.org>, Arthur Barstow <art.barstow@nokia.com>, Brad Hill <bhill@paypal-inc.com>, Eric Rescorla <ekr@rtfm.com>, Alexey Melnikov <alexey.melnikov@isode.com>, David Ross <dross@microsoft.com>, Anne van Kesteren <annevk@opera.com>, Adrian Bateman <adrianba@microsoft.com>, Brandon Sterne <bsterne@mozilla.com>, Adam Barth <abarth@gmail.com>, Charles McCathieNevile <chaals@opera.com>, Maciej Stachowiak <mjs@apple.com>
(Warning, this is cross-posted widely. One of the lists is the IETF websec mailing list, to which the IETF NOTE WELL applies: http://www.ietf.org/about/note-well.html)


Folks,

there appear to be at least three possible specifications addressing this space, with similar but different designs:

1. A proposed deliverable in the WebAppSec group to take up on X-Frame-Options and express those in CSP:
  http://www.w3.org/2011/07/appsecwg-charter.html

(We expect that this charter might go to the W3C AC for review as soon as next week.)

2. The "From-Origin" draft (aka "Cross-Origin Resource Embedding Exclusion") currently considered for publication as an FPWD in the Webapps WG:
  http://lists.w3.org/Archives/Public/public-webapps/2011JulSep/0088.html

This draft mentions integration into CSP as a possible path forward.

3. draft-gondrom-frame-options, an individual I-D mentioned to websec: 
  https://datatracker.ietf.org/doc/draft-gondrom-frame-options/
  http://www.ietf.org/mail-archive/web/websec/current/msg00388.html


How do we go about it?  One path forward might be to just proceed as currently planned and coordinate when webappsec starts working.

Another path forward might be to see whether we can agree now on what forum to take these things forward in (and what the coordination dance might look like).

Thoughts welcome.

Regards,
--
Thomas Roessler, W3C  <tlr@w3.org>  (@roessler)
Received on Thursday, 7 July 2011 21:12:36 GMT

This archive was generated by hypermail 2.3.1 : Tuesday, 26 March 2013 18:49:46 GMT