Subject: [apps-discuss] WG Summary: WebSec

From: Yoav Nir <[email-masked]>
Date: Mon, 29 Jul 2013 14:46:02 +0000

WebSec met on Monday at 15:10 for 1 hour.

X-Frame-Options is out of the working group, and IETF LC has begun (today)

Framework-Reqs has not progressed since the last meeting.

HTTP Public Key Pinning has gone through WGLC, a few issues were raised, and discussed in the session. The (apparent) consensus will be verified on the list.

We also discussed the potential new work item - session continuation (also known as "session management" and "Cookiev2"). There was little energy in the room, with only about 5 people willing to commit to review the problem statement or "judge" in a beauty contest among proposals. We don't feel that this justifies asking the ADs to add this to our charter. Some suggestions have been made: to go straight to solution documents, to approach browser vendors to see whether they are interested. The chairs will take this as homework.

Tobias & Yoav

---

From: Julian Reschke <[email-masked]>
Date: Mon, 29 Jul 2013 16:54:00 +0200

On 2013-07-29 16:46, Yoav Nir wrote:
> ...

+1

That being said, what about draft-ietf-websec-frame-options? (note the 
missing "x-")

Best regards, Julian

---

From: Yoav Nir <[email-masked]>
Date: Mon, 29 Jul 2013 15:00:47 +0000

On Jul 29, 2013, at 4:54 PM, Julian Reschke <[email-masked]>
 wrote:

> That being said, what about draft-ietf-websec-frame-options? (note the missing "x-")
> 

WebAppSec (from W3C) made the case for this to be part of CSP, so they own that work item now.  It's out of our charter.

Yoav