#280: `sec-metadata`

Visit on Github.

Opened May 15, 2018

Good morning, friendly TAG!

I'm requesting a (p)review of:

Further details (optional):

  • Relevant time constraints or deadlines: None. Just an early directional review (and invitation to a naming/spelling bikeshed).
  • I am passingly familiar with the Self-Review Questionnare on Security and Privacy. This proposal does have some privacy implications insofar as it reveals whether a request was made from a cross-origin/site page, even in the face of a referrer policy that would prevent leaking the URL. The granularity is low enough that I'll boldly claim that the value seems to outweigh the marginal risk.
  • I have reviewed the TAG's API Design Principles

You should also know that you're probably my favorite web architecture review body. Top 10, certainly.

We'd prefer the TAG provide feedback as (please select one):

  • open issues in our Github repo for each point of feedback
  • open a single issue in our Github repo for the entire review
  • leave review feedback as a comment in this issue and @-notify [github usernames]

Discussions

2018-11-28

Minutes

Yves: Mnot posted a blog post on how to design http headers optimised for hpack - https://www.mnot.net/blog/2018/11/27/header_compression

Alex: what is the overall header bloat issue - what is the budget?

Yves: i think it's a separate issue - not related to sec metadata in itself. I suggest asking mark or others in the http working group we can ask this.

[closed