W3C home > Mailing lists > Public > public-webappsec@w3.org > February 2015

Re: WebAppSec re-charter status

From: Anne van Kesteren <annevk@annevk.nl>
Date: Thu, 12 Feb 2015 21:35:57 +0100
Message-ID: <CADnb78h7TEixT=x-09ERWHEEyQkUW4M9Akdz4okCP72todkiHw@mail.gmail.com>
To: "Eduardo' Vela <Nava>" <evn@google.com>
Cc: Mounir Lamouri <mlamouri@google.com>, Daniel Veditz <dveditz@mozilla.com>, Wendy Seltzer <wseltzer@w3.org>, "public-webappsec@w3.org" <public-webappsec@w3.org>, Deian Stefan <deian@cs.stanford.edu>, Devdatta Akhawe <dev.akhawe@gmail.com>, David Baron <dbaron@dbaron.org>, Mike West <mkwst@google.com>, Jeffrey Yasskin <jyasskin@google.com>, Brad Hill <hillbrad@gmail.com>, David Ross <drx@google.com>, Martin Thomson <martin.thomson@gmail.com>
On Thu, Feb 12, 2015 at 9:32 PM, Eduardo' Vela" <Nava> <evn@google.com> wrote:
> The status quo is that someone that wanted to make deep linking impossible
> on their site, would need to 403 all requests without the right referrer.

The last time Google studied that header I think it turned out for 5%
of users things would break if something like that were to happen.
It's why we have a distinct Origin header. Now if we limit things to
TLS, maybe?


-- 
https://annevankesteren.nl/
Received on Thursday, 12 February 2015 20:36:20 UTC

This archive was generated by hypermail 2.3.1 : Monday, 23 October 2017 14:54:10 UTC