{"action":"created","issue":{"url":"https://api.github.com/repos/reschke/oobencoding/issues/14","repository_url":"https://api.github.com/repos/reschke/oobencoding","labels_url":"https://api.github.com/repos/reschke/oobencoding/issues/14/labels{/name}","comments_url":"https://api.github.com/repos/reschke/oobencoding/issues/14/comments","events_url":"https://api.github.com/repos/reschke/oobencoding/issues/14/events","html_url":"https://github.com/reschke/oobencoding/issues/14","id":162387175,"number":14,"title":"Cross-origin requests for secondary resources","user":{"login":"martinthomson","id":67641,"avatar_url":"https://avatars.githubusercontent.com/u/67641?v=3","gravatar_id":"","url":"https://api.github.com/users/martinthomson","html_url":"https://github.com/martinthomson","followers_url":"https://api.github.com/users/martinthomson/followers","following_url":"https://api.github.com/users/martinthomson/following{/other_user}","gists_url":"https://api.github.com/users/martinthomson/gists{/gist_id}","starred_url":"https://api.github.com/users/martinthomson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/martinthomson/subscriptions","organizations_url":"https://api.github.com/users/martinthomson/orgs","repos_url":"https://api.github.com/users/martinthomson/repos","events_url":"https://api.github.com/users/martinthomson/events{/privacy}","received_events_url":"https://api.github.com/users/martinthomson/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-06-27T07:11:29Z","updated_at":"2016-07-19T16:40:09Z","closed_at":null,"body":"When making a request for the secondary resource, it's not clear what the properties of this request need to look like.\r\n\r\nWe could treat this as a full CORS request with a requirement for a pre-flight.  That would be devastating for latency, but we could easily reason that it is safe.\r\n\r\nWe could take something of a lassez-faire approach to this and allow all credentials.  That has certain risks associated with it.  Even though I've tried, but cannot find a way in which this could be abused, we would have to do a lot of analysis to determine that it truly wasn't a problem.  That and I'm not certain that we need to do this.  One real downside is that it would allow the secondary server to track requests across origins.\r\n\r\nThe safest and fastest option is to withhold credentials on requests to the secondary resource.  It's fast, and it's safe by default.\r\n\r\nIn the end, I think that the credential-free option is safest, unless we both a) discover a need for credentials, and b) are able to convince ourselves that the costs are small and manageable.\r\n\r\nThe current draft says this:\r\n\r\n    In order to prevent any leakage of information, the GET request for\r\n    the secondary resource MUST only contain information provided by the\r\n    origin server or the secondary server itself, namely HTTP\r\n    authentication credentials ([RFC7235]) and cookies ([RFC6265]).\r\n\r\nWe probably need to be a bit clearer about this, maybe with reference to (or by copying) the bit in the fetch spec that covers `withCredentials: false`."},"comment":{"url":"https://api.github.com/repos/reschke/oobencoding/issues/comments/233692417","html_url":"https://github.com/reschke/oobencoding/issues/14#issuecomment-233692417","issue_url":"https://api.github.com/repos/reschke/oobencoding/issues/14","id":233692417,"user":{"login":"reschke","id":332994,"avatar_url":"https://avatars.githubusercontent.com/u/332994?v=3","gravatar_id":"","url":"https://api.github.com/users/reschke","html_url":"https://github.com/reschke","followers_url":"https://api.github.com/users/reschke/followers","following_url":"https://api.github.com/users/reschke/following{/other_user}","gists_url":"https://api.github.com/users/reschke/gists{/gist_id}","starred_url":"https://api.github.com/users/reschke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/reschke/subscriptions","organizations_url":"https://api.github.com/users/reschke/orgs","repos_url":"https://api.github.com/users/reschke/repos","events_url":"https://api.github.com/users/reschke/events{/privacy}","received_events_url":"https://api.github.com/users/reschke/received_events","type":"User","site_admin":false},"created_at":"2016-07-19T16:40:08Z","updated_at":"2016-07-19T16:40:08Z","body":"Idea: define a media type for the payload returned by the secondary server, such as \"application/oob-blob\". Require OOB processing to check for that media type and abort for any content not having it. That would protect any content that doesn't happen to be coming from a cache server."}}
{"actor":{"display_login":"reschke"}}