Re: [w3ctag/design-reviews] Distributed Tracing WG: Baggage specification (#650)

> For the baggage header, the user-agent will not do anything other than send the header.

This on its own is concerning security-wise and should be covered in the spec and explainer. For example, what happens on cross-origin requests (e.g. those made in `no-cors` mode): would the baggage header be included? How should cross-origin redirects be handled?  

I think a conceptually simple way to address this could be to guarantee that the baggage header can only be attached on requests that are same-origin to the response that included the baggage information. The spec already mentions that baggage data "does not leak beyond defined trust boundaries" but my guess is that the folks working on this need to put a little more thought into how this would work on the web.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/650#issuecomment-884692993