Re: [whatwg/fetch] Update Fetch to support Token Binding. (#325)

vanupam commented on this pull request.



> +<dfn export id=concept-token-binding>token binding</dfn>.
+
+<p>The technique is described in
+detail in [[TOKBIND-NEGOTIATION]], [[TOKBIND-PROTOCOL]], and [[TOKBIND-HTTPS]].
+
+<p>A <dfn export id=token-binding-id>token binding ID</dfn> is the representation
+of a <a for=/>token binding</a>, as described in
+<a href="https://tools.ietf.org/html/draft-ietf-tokbind-protocol#section-3.2">section 3.2</a>
+of [[TOKBIND-PROTOCOL]].
+
+<p>At a very high level, a user agent negotiates the use of Token Binding when it
+sets up a TLS connection to a server.
+The user agent maintains a Token Binding key store, where it saves different
+<a for=/>token binding ID</a>s to be used with different servers.
+It maintains <a for=/>token binding ID</a>s at the granularity of
+effective top-level domain (public suffix) + 1 (eTLD+1).

In web browsers, the goal - per the Token Binding over HTTP spec section 2.1, is to match the coarsest level that cookies can be set at as in RFC6265 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/325#discussion_r106535244