Re: Trusted Proxy Alternatives Analysis

Le Mar 11 février 2014 03:39, Mark Nottingham a écrit :
> Nicolas,
>
> Can you expand upon that? A throwaway dismissal like that doesn't really
> help.

The integrity hash is buried in the html page (content). Therefore, when a
web client will perform a GET on one of those resources, proxies will only
see the URL and have no way to know it should be checked against
something.

For the security to be effective the integrity metadata needs to be
propagated in the web client http commands.

Regards,

-- 
Nicolas Mailhot

Received on Tuesday, 11 February 2014 19:06:20 UTC