Re: Kathleen Moriarty's Discuss on draft-ietf-httpbis-rfc7238bis-02: (with DISCUSS)

On 2015-02-04 14:53, Kathleen Moriarty wrote:
> Hi Julian,
>
> Thanks for your quick response.  My intent wasn't to hold this up,
> although the thought of eliminating vulnerabilities that could be
> sources of compromise is really attractive having managed incident
> response teams. :-)
>
> Yes, I agree this also applies to redirects and that would require an
> update to RFC7231.  For this, could you write text to strongly
> recommend use of TLS with this feature explaining the hazards?

Updating RFC 7231 requires consensus in the WG (and in the IETF, for 
that matter). I also don't believe we have consensus for a 
recommendation not to use permanent redirects on HTTP.

We *could* point out the problem, but then, there are so many other 
similar problems applicable to non-encrypted HTTP that I really don't 
see why this one deserves to be called specifically.

> ...


Best regards, Julian

Received on Wednesday, 4 February 2015 14:01:19 UTC