Repository navigation
Capability URL problem bigger than advertized #155
Description
Given that quite often capability URLs are origin + path I think https://w3c.github.io/reporting/#capability-urls needs improving. It's rather seldom that capabilities are stored in username/password/fragment. While good that they are stripped, selling that as solving the problem (apart from body) is not good.
Activity
dcreager commentedon May 14, 2019
You're right that stripping username/password from the URL isn't enough! The analogous section in the NEL spec (last paragraph of §9) instead says that if you're encoding permissions in URL paths, you should run your own collectors and not upload reports to third parties. Would you consider that language sufficient?
annevk commentedon May 14, 2019
Yeah, that seems more reasonable. In particular whatever we say should work for GitHub's gists and Flickr (at least I remember that using these, not sure if that's still the case).
Expand on capability URL privacy hazards.
clelland commentedon Feb 17, 2021
I've taken another stab at the wording here, trying to include:
I've also referenced the TAGs findings directly.
Merge pull request #230 from w3c/capability-urls