3 ms·

That's a very HTML specific HTTP header and it seems very out of place.

johncolanduoni 8y ago
There are already tons of HTML specific HTTP headers (Link, CSP, X-Frame-Options, etc.). I don’t see why HTTP headers shouldn’t be used for metadata when serving HTML, it’s not like the header needs to be added to the HTTP spec.
- JD557 8y ago
  I think this would look better as some kind of <meta> tag inside the HTML document. I think that the document itself should have knowledge about its security requirements (the "allow" field in <iframe> tags requires this), so it seems awkward to have part of the responsibility in the HTTP server and another part in the HTML document.
  - klodolph 8y ago
    As a website operator, I should be able to have some guarantees about the security of my site without auditing every single piece of HTML, JavaScript, and CSS. That might be far from a trivial task if my site has user-generated content... beyond forums, there are also blogs and CMSs. HTML, JS, and CSS are fast moving targets and something that is safe today could easily have security implications down the road when a new feature arrives. This has happened before and it will happen again.
- jasonkostempski 8y ago
  Link is not HTML specific. Content-Security-Policy can also be specified as an HTML meta tag, that's where it belongs. CSP obsoletes X-Frame-Options which couldn't be specified as a meta tag only because MS made up that rule when they made up the header, with no justification for it. Everyone followed suit simply because that's what people had to do when MS had a stranglehold on the internet. I'm sure there are other examples of HTML specific HTTP headers that can't be specified as meta tags because we're still stuck with a lot of crud, but that doesn't mean they're not out of place too. It's just the wrong layer for that data.
  - epmatsw 8y ago
    The CSP info is a little off. Specifically, there are some directives of CSP (in this case frame-ancestors, the replacement for X-Frame-Options) that are specifically ignored if specified in a only <meta> tag. The header is the only way to have access the full set of CSP features.
    - jasonkostempski 8y ago
      I see that. I couldn't find any justification for that choice either. Any reason I can think of (security, legacy, optimization) would imply the powers that be wouldn't want CSP allowed as a meta tag either. My guess is it's just another bad choice. I've had iframes completely disabled in uBlock Origin for years now and the only time I've found it "breaking" ("fixing" from my perspective) things is when sites do something like third-party run sweepstakes. I think we'd be better off just breaking iframes now for the sake of our children, like we did with Flash et al. Start off with "click to activate iframe" with harsh warnings, then completely remove support shortly after. There are better solutions for sites that are using it for legit reasons.
eximius 8y ago
What exactly do you think HTTP stands for? I'll give you a hint: both HTML and HTTP share an HT.

There are already tons of HTML specific HTTP headers (Link, CSP, X-Frame-Options, etc.). I don’t see why HTTP headers shouldn’t be used for metadata when serving HTML, it’s not like the header needs to be added to the HTTP spec.

JD557 8y ago
I think this would look better as some kind of <meta> tag inside the HTML document. I think that the document itself should have knowledge about its security requirements (the "allow" field in <iframe> tags requires this), so it seems awkward to have part of the responsibility in the HTTP server and another part in the HTML document.
- klodolph 8y ago
  As a website operator, I should be able to have some guarantees about the security of my site without auditing every single piece of HTML, JavaScript, and CSS. That might be far from a trivial task if my site has user-generated content... beyond forums, there are also blogs and CMSs. HTML, JS, and CSS are fast moving targets and something that is safe today could easily have security implications down the road when a new feature arrives. This has happened before and it will happen again.
jasonkostempski 8y ago
Link is not HTML specific. Content-Security-Policy can also be specified as an HTML meta tag, that's where it belongs. CSP obsoletes X-Frame-Options which couldn't be specified as a meta tag only because MS made up that rule when they made up the header, with no justification for it. Everyone followed suit simply because that's what people had to do when MS had a stranglehold on the internet. I'm sure there are other examples of HTML specific HTTP headers that can't be specified as meta tags because we're still stuck with a lot of crud, but that doesn't mean they're not out of place too. It's just the wrong layer for that data.
- epmatsw 8y ago
  The CSP info is a little off. Specifically, there are some directives of CSP (in this case frame-ancestors, the replacement for X-Frame-Options) that are specifically ignored if specified in a only <meta> tag. The header is the only way to have access the full set of CSP features.
  - jasonkostempski 8y ago
    I see that. I couldn't find any justification for that choice either. Any reason I can think of (security, legacy, optimization) would imply the powers that be wouldn't want CSP allowed as a meta tag either. My guess is it's just another bad choice. I've had iframes completely disabled in uBlock Origin for years now and the only time I've found it "breaking" ("fixing" from my perspective) things is when sites do something like third-party run sweepstakes. I think we'd be better off just breaking iframes now for the sake of our children, like we did with Flash et al. Start off with "click to activate iframe" with harsh warnings, then completely remove support shortly after. There are better solutions for sites that are using it for legit reasons.

eximius 8y ago

What exactly do you think HTTP stands for? I'll give you a hint: both HTML and HTTP share an HT.