Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:68179
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.128.44 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAN=kQJeDH-BomNqTAadVUjO2TuSHFKEvSxPj3qkU3vrKVN=fvw@mail.gmail.com>
References: <CAH8Mpnmn8MMEN-WLRLSvgppe5RzPjK6NwyXhyuh7FDKU4fxfuA@mail.gmail.com>
 <CAN=kQJctJfkZ-DtJFH1cOouWO9EQG+ja_Gqm6diX62v9PD2DjQ@mail.gmail.com>
 <CAA=k7mWP_Nn_wJp9VdaQ4vxCCZQmbBaFsHyzOPVjkRK3LRNbNQ@mail.gmail.com> <CAN=kQJeDH-BomNqTAadVUjO2TuSHFKEvSxPj3qkU3vrKVN=fvw@mail.gmail.com>
Date: Fri, 19 Jul 2013 09:03:50 +0900
Message-ID: <CAGa2bXYcEPpeYxh=c-5XoKbM2+u=pmS7hb2vkWueC5z5BJXPbg@mail.gmail.com>
To: Matthew Leverton <leverton@gmail.com>
Cc: Mario Brandt <jblond@gmail.com>, Daniel Lowrey <rdlowrey@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=20cf303346512482d104e1d212bc
Subject: Re: [PHP-DEV] Re: Access-Control-Allow-Origin header in CLI server
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--20cf303346512482d104e1d212bc
Content-Type: text/plain; charset=ISO-8859-1

Hi Matthew,

2013/7/7 Matthew Leverton <leverton@gmail.com>

> On Sat, Jul 6, 2013 at 7:59 AM, Mario Brandt <jblond@gmail.com> wrote:
> > You can use the router script to add that header of your desire into
> > every request.
> >
> That's what I currently do. And I agree that if somebody wants to
> deviate from the reasonable set of defaults that PHP provides, then he
> must set them in a router script. I don't think the CLI server should
> be a configurable web server.
>
> But IMO, this is no different from PHP maintaining and delivering a
> small set of Content-type headers. Of course you could take the same
> hardline approach and tell the developer to set all of the content
> headers himself because you're worried that somebody might use PNG as
> a data file that holds ping pong scores. But neither the existence of
> this nor the content-type have any reasonable side effects.
>
> I'm just throwing this out here; I've got nothing more to say and am
> fine with the powers-to-be doing whatever they feel appropriate.


It would be nice if PHP encourages secure web application development.

Not only having

 Access-Control-Allow-Origin

but also

  'X-Frame-Options' => 'SAMEORIGIN',
  'X-XSS-Protection' => '1; mode=block',
  'X-Content-Type-Options' => 'nosniff'

headers are best practice for better security.
It may not be suitable as PHP core setting. However, it would
be great for many users to have these as new core module setting.
PHP would be better if PHP promotes secure app development.

Number of recommended HTTP headers may increase.
Perhaps, we should have php.ini entry that specify any HTTP headers
and set defaults in php.ini-*

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--20cf303346512482d104e1d212bc--