Request-Off-The-Record Mode header

Hi folks, this is a head's up and early request for feedback:

Brave is shipping support for an HTTP response header sent by a website
that wants the client to treat the website as "off-the-record" i.e. not
store anything in storage, not record the site visit in history etc. Kind
of like incognito/private browsing mode but site-initiated and only for a
specific website. The header is simple: it would look like `Request-OTR:
1`. Some details here:
https://brave.com/privacy-updates/26-request-off-the-record/#request-otr-header.
Currently
we bootstrap for websites that have expressed interest in this (mainly
websites that have help resources for domestic violence victims, which was
the driving use-case) by preloading a list of websites into the browser,
but it would be nice to standardize the header. We're considering doing the
work in the HTTP WG at IETF: it's envisioned to be a simple header.

I see that this idea was previously discussed in W3C WebAppSec:
https://lists.w3.org/Archives/Public/public-webappsec/2015Sep/0016.html,
and there was a draft Mozilla spec:
https://wiki.mozilla.org/Security/Automatic_Private_Browsing_Upgrades,
though as a CSP directive.

Happy to hear what people think.

Received on Thursday, 8 June 2023 19:15:07 UTC