Subject: Re: [httpwg/http-extensions] Accept-CH-Lifetime privacy concerns (#372)

From: HTTP issue updates <[email-masked]>
Date: Tue, 20 Mar 2018 09:52:10 -0700

I'm confused by this text, given my understanding of the resolution of this issue:
>    Implementers SHOULD restrict delivery of some or all Client Hints
      header fields to the opt-in origin only, unless the opt-in origin
      has explicitly delegated permission to another origin to request
      Client Hints header fields.

Why SHOULD and not MUST? Why the qualification of "some or all"? If explicit delegation of permission is required (through feature policy or some other means), shouldn't we just say so? Also, would it help to cite Feature Policy explicitly?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/372#issuecomment-374673006

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 26 Mar 2018 17:52:33 -0700

I don't think we can or should assume that the only "client" for CH is a browser. I may be building a (native) app that's not subject to this and hence SHOULD. Does that sound reasonable?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/372#issuecomment-376359338