Skip to content

Commit 23d154e

Browse files
committed
Remove superfluous text
1 parent e45ef8f commit 23d154e

File tree

1 file changed

+0
-2
lines changed

1 file changed

+0
-2
lines changed

protocol.html

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -911,8 +911,6 @@ <h3 property="schema:name">Security Considerations</h3>
911911
<p>Servers <a href="#cors-server">disable all cross-origin protections</a> in browsers because resource access is governed explicitly by <a href="#web-access-control">Web Access Control</a>. As such, servers cannot rely on browser-based cross-origin protection mechanisms for determining the authentication status or representation of a resource. In particular, servers are strongly encouraged to ignore HTTP cookies from untrusted origins. Additional security measures can be taken to prevent metadata in error responses from leaking. For instance, a malicious application could probe multiple servers to check whether the response status code is <code>401</code> or <code>403</code>, or could try to access an error page from an intranet server within the user agent’s private network to extract company names or other data. To mitigate this, when a request from an untrusted <code>Origin</code> arrives, the server may want to set the status code of error responses to <code>404</code> and/or anonymize or censor their contents.</p>
912912

913913
<p>Servers are encouraged to use TLS connections to protect the contents of requests and responses from eavesdropping and modification by third parties. Unsecured TCP connections without TLS may be used in testing environments or when the data pod is behind a reverse proxy that terminates a secure connection.</p>
914-
915-
<p>In addition to above considerations, implementors should consider the Security Considerations in context of the <cite><a href="https://solidproject.org/TR/protocol">Solid Protocol</a></cite></p>.
916914
</div>
917915
</section>
918916

0 commit comments

Comments
 (0)