Subject: [apps-discuss] Fwd: [websec] FYI: New draft draft-gondrom-frame-options-01

From: Tobias Gondrom <[email-masked]>
Date: Tue, 15 Mar 2011 23:52:58 +0000

Folks,
just FYI as this (HTTP Header Frame-Options) may be of interest for apps
area as well.
- Tobias (websec)

-------- Original Message --------
Subject: 	[websec] FYI: New draft draft-gondrom-frame-options-01
Date: 	Tue, 15 Mar 2011 21:43:52 +0000
From: 	Tobias Gondrom <[email-masked]>
To: 	[email-masked]
CC: 	[email-masked]

Hello dear fellow websec colleagues,

following up on some discussions at the OWASP Summit last month, David
Ross and I decided to write up a draft on Frame-Options (currently know
as X-Frame-Options) and to develop this further as a standard:
https://datatracker.ietf.org/doc/draft-gondrom-frame-options/

The draft is still a little bit rough on the edges and e.g. how it works
with websec-origin, but I hope we can sort out some of the details in
Prague and with your feedback on the mailing-list.

Kind regards,

Tobias

Ps.: and on a note as websec chair: although I believe this draft to be
relevant in websec scope, I submitted it as individual draft initially,
so we can have a first discussion and have a proper look for feedback
whether the WG wants to adopt this draft or not.

-------- Original Message --------
Subject: 	New Version Notification for draft-gondrom-frame-options-01
Date: 	Mon, 14 Mar 2011 16:19:55 -0700 (PDT)
From: 	IETF I-D Submission Tool <[email-masked]>
To: 	[email-masked]

A new version of I-D, draft-gondrom-frame-options-01.txt has been successfully submitted by Tobias Gondrom and posted to the IETF repository.

Filename:	 draft-gondrom-frame-options
Revision:	 01
Title:		 HTTP Header Frame Options
Creation_date:	 2011-03-15
WG ID:		 Independent Submission
Number_of_pages: 9

Abstract:
To improve the protection of web applications against Cross Site
Request Forgery (CSRF) and Clickjacking this standards defines a http
response header that declares a policy communicated from a host to
the client browser whether the transmitted content MUST NOT be
displayed in frames of other pages from different origins or a list
of trusted origins which are allowed to frame the content.

The IETF Secretariat.