Changeset 2130 for draft-ietf-httpbis/latest

Timestamp:

19/01/13 14:45:56 (10 years ago)

Author:

fielding@…

Message:

add a security consideration for entity-tag tracking

Location:

draft-ietf-httpbis/latest

Files:

• p4-conditional.html (modified) (2 diffs)
• p4-conditional.xml (modified) (2 diffs)

draft-ietf-httpbis/latest/p4-conditional.html

@@ -1207 +1207 @@
       <h1 id="rfc.section.7"><a href="#rfc.section.7">7.</a>&nbsp;<a id="security.considerations" href="#security.considerations">Security Considerations</a></h1>
       <p id="rfc.section.7.p.1">This section is meant to inform developers, information providers, and users of known security concerns specific to the HTTP/1.1
-         conditional request mechanisms. No additional security considerations have been identified beyond those applicable to HTTP
-         messaging <a href="#Part1" id="rfc.xref.Part1.5"><cite title="Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing">[Part1]</cite></a> and semantics <a href="#Part2" id="rfc.xref.Part2.4"><cite title="Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content">[Part2]</cite></a>.
+         conditional request mechanisms. More general security considerations are addressed in HTTP messaging <a href="#Part1" id="rfc.xref.Part1.5"><cite title="Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing">[Part1]</cite></a> and semantics <a href="#Part2" id="rfc.xref.Part2.4"><cite title="Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content">[Part2]</cite></a>.
       </p>
       <p id="rfc.section.7.p.2">The validators defined by this specification are not intended to ensure the validity of a representation, guard against malicious
@@ -1214 +1213 @@
          writes when all participants are behaving nicely. At worst, the conditions will fail and the client will receive a response
          that is no more harmful than an HTTP exchange without conditional requests.
+      </p>
+      <p id="rfc.section.7.p.3">An entity-tag can be abused in ways that create privacy risks. For example, a site might deliberately construct a semantically
+         invalid entity-tag that is unique to the user or user agent, send it in a cacheable response with a long freshness time, and
+         then read that entity-tag in later conditional requests as a means of re-identifying that user or user agent. Such an identifying
+         tag would become a persistent identifier for as long as the user agent retained the original cache entry. User agents that
+         cache representations ought to ensure that the cache is cleared or replaced whenever the user performs privacy-maintaining
+         actions, such as clearing stored cookies or changing to a private browsing mode.
       </p>
       <h1 id="rfc.section.8"><a href="#rfc.section.8">8.</a>&nbsp;<a id="acks" href="#acks">Acknowledgments</a></h1>

draft-ietf-httpbis/latest/p4-conditional.xml

@@ -1107 +1107 @@
    This section is meant to inform developers, information providers, and
    users of known security concerns specific to the HTTP/1.1 conditional
-   request mechanisms. No additional security considerations have been
-   identified beyond those applicable to HTTP messaging &messaging; and
-   semantics &semantics;.
+   request mechanisms. More general security considerations are addressed
+   in HTTP messaging &messaging; and semantics &semantics;.
 </t>
 <t>
@@ -1119 +1118 @@
    response that is no more harmful than an HTTP exchange without conditional
    requests.
+</t>
+<t>
+   An entity-tag can be abused in ways that create privacy risks. For example,
+   a site might deliberately construct a semantically invalid entity-tag that
+   is unique to the user or user agent, send it in a cacheable response with a
+   long freshness time, and then read that entity-tag in later conditional
+   requests as a means of re-identifying that user or user agent. Such an
+   identifying tag would become a persistent identifier for as long as the
+   user agent retained the original cache entry. User agents that cache
+   representations ought to ensure that the cache is cleared or replaced
+   whenever the user performs privacy-maintaining actions, such as clearing
+   stored cookies or changing to a private browsing mode.
 </t>
 </section>