Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Should link relations define the behaviour of the user agent following a link? #1

Open
darrelmiller opened this issue Nov 3, 2024 · 0 comments

Comments

@darrelmiller
Copy link
Collaborator

This issue is a based on feedback from a SECDIR review:

If a user follows one of these links, should it replace the page content or
open separately? If it opens separately, should it autoclose when the action
(e.g. "login") completes, and if so how? (This is more ergonomic but creates
risk related to "clickjacking".) Should the page content be reloaded after a
login state change? * What format does "authenticated-as" provide? It seems
like the intent here would be to support a "chip" in the browser chrome showing
the logged-in user's name (and icon/picture?), but this would require
specifying the actual format of the resource, which is not done here.

https://datatracker.ietf.org/doc/review-ietf-httpapi-authentication-link-01-secdir-early-schwartz-2024-06-28/

The general question here is it expected for link relation types to define the behaviour of user agents that follow links?

@darrelmiller darrelmiller moved this to In Discussion in HttpApi Active Issues Nov 5, 2024
@darrelmiller darrelmiller moved this from In Discussion to Waiting on response in HttpApi Active Issues Nov 5, 2024
@darrelmiller darrelmiller moved this from Waiting on response to In Discussion in HttpApi Active Issues Nov 5, 2024
@darrelmiller darrelmiller moved this from In Discussion to Seeking Feedback in HttpApi Active Issues Nov 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Seeking Feedback
Development

No branches or pull requests

1 participant