On Wed, Feb 11, 2009 at 4:43 PM, Adam Barth <[email protected]> wrote:
> On Wed, Feb 11, 2009 at 4:40 PM, Breno de Medeiros <[email protected]> > wrote: > > Yes, but your solution prevents legitimate use cases that are a higher > value > > proposition. > > How does: > > On Wed, Feb 11, 2009 at 3:22 PM, Adam Barth <[email protected]> wrote: > > 2) Add a section to Security Considerations that explains that > > applications using host-meta should consider adding requirement (1) > [strict Content-Type processing]. > > prevent legitimate use cases? > > It's not the ideal solution because it passes the buck to > application-land, but its orders of magnitude better than laying a > subtle trap for those folks. Ah, thought that you were still suggesting that this be a spec requirement. What about browser-based applications using host-meta ... > > > Adam > -- --Breno +1 (650) 214-1007 desk +1 (408) 212-0135 (Grand Central) MTV-41-3 : 383-A PST (GMT-8) / PDT(GMT-7)
