Subject: Re: Last Call: <draft-levine-herkula-oneclick-04.txt> (Signalling one-click functionality for list email headers) to Proposed Standard (fwd)

From: "John R. Levine" <[email-masked]>
Date: 20 Sep 2016 19:54:13 -0400

>> Nothing personal, but for interop purposes, the opinions of ops people
>> at large mail systems matter a lot more than your opinion or mine.
>
>They may have their views, but the spec is for the world at large,
>and I do think that the "email unsubs may DoS the sender" rationale
>will be seen as a feature and not a bug by many potential adopters.
>We can provide a more broadly useful rationale.

We seem unable to agree on why we're not doing one-click mailto:, and in 
any event since we're not doing it, it's irrelevant to the spec, so I 
commented the paragraph out of -06.

>There's a reason why browsers send "Origin:" headers, the MUA should
>do the same when doing POST requests based on email headers.

MUAs have been doing GETs and, for messages with forms in them, POSTs
for over a decade.  What origin headers do they send now?  Why is this
different?

R's,
John

---

From: Viktor Dukhovni <[email-masked]>
Date: Tue, 20 Sep 2016 20:01:05 -0400

> On Sep 20, 2016, at 7:54 PM, John R. Levine <[email-masked]> wrote:
> 

I take no issue with GETs.  The "Origin:" header is comparatively new,
and AFAIK should be present in all POSTs that are triggered via email
content.

Perhaps some of the MUAs that submit forms (sorry, I don't use any that
do) predate "Origin:".  It may also possible that in this context adding
"Origin" is not a useful cross-origin security measure.  I hope someone
more knowlegeable in HTTP security will chime in.

-- 
-- 
	Viktor.