Subject: Re: [websec] Last Call: <draft-ietf-websec-x-frame-options-07.txt> (HTTP Header Field X-Frame-Options) to Informational RFC

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 29 Jul 2013 15:57:40 +0200

On 7/29/13 11:37 AM, The IESG wrote:
> 
> The IESG has received a request from the Web Security WG (websec)
> to consider the following document: - 'HTTP Header Field
> X-Frame-Options' <draft-ietf-websec-x-frame-options-07.txt> as
> Informational RFC

Section 1 states:

   This specification provides informational documentation about the
   current use and definition of the X-Frame-Options HTTP header field.
   Given that the "X-" construction is deprecated [RFC6648], the X
   -Frame-Options header field will in the future be replaced by the
   Frame-Options directive in the Content Security Policy Version 1.1
   [CSP-1-1].

IMO, RFC 6648 does not necessitate deprecating the X-Frame-Options
header field in favor of the Frame-Options header field, since RFC
6648 is not retroactive. We might want to make the relationship
clearer here.

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/