Skip to content

Consider applying the robustness principle with regard to user agent request validation #100

Open
@tplooker

Description

@tplooker

For those unfamiliar with this principle, it boils down to

be conservative in what you do, be liberal in what you accept from others". It is often reworded as: "be conservative in what you send, be liberal in what you accept"

With regard to this API I would suggest the user agent / browser apply this philosophy when considering whether to, or how to perform request validation, to the extent it makes sense.

For example it may make sense for the browser to validate parts of a request to ensure it is well formed syntax wise, which might have certain developer ergonomic benefits and or security benefits, I do think this needs to be carefully analysed though and not just assumed the whole request must be strictly validated. Furthermore, I think it would be a mistake and would severely limit future extensibility if the user agent were to strictly validate the request, that is, in the event the browser receives a request which contains elements it doesn't understand, it shouldn't error, fail to forward the request to a wallet or only forward the request to the wallet with known request elements.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions