You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Section 6.3 in https://www.w3.org/TR/trace-context/?msclkid=8fb94facc59711eca3572297845ae7e1#other-risks
"When vendors include traceparent and tracestate headers in responses, these values may inadvertently be passed to cross-origin callers. Vendors should ensure that they include only these response headers when responding to systems that participated in the trace."
Assigning to Philippe per our discussion in the WG meeting today for checking if this can be an editorial change.
The text was updated successfully, but these errors were encountered:
Daniel pointed out that the above wording is for any responses that include the above information (and not necessarily pointing to the response headers we want to standardize going forward). Per the discussion in the WG meeting, I will update the second sentence (in the current draft, not in Level 1) to remove the wording "response headers" to something like "responses" or response values.
kalyanaj
changed the title
The Level 1 spec talks about risks related to response headers in privacy section, but response headers are not part of this version
Update wording on "response headers" in privacy section to disambiguate from traceresponse headers.
Sep 26, 2022
kalyanaj
added a commit
to kalyanaj/trace-context
that referenced
this issue
Sep 26, 2022
Should we remove this from the Level 1 spec?
Section 6.3 in https://www.w3.org/TR/trace-context/?msclkid=8fb94facc59711eca3572297845ae7e1#other-risks
"When vendors include traceparent and tracestate headers in responses, these values may inadvertently be passed to cross-origin callers. Vendors should ensure that they include only these response headers when responding to systems that participated in the trace."
Assigning to Philippe per our discussion in the WG meeting today for checking if this can be an editorial change.
The text was updated successfully, but these errors were encountered: