Mark Nottingham

HTTPS-specific checks

7

RED should support HTTPS URLs as well. This means changes in nbhttp as well as some modification of the caching logic.

If a response has a non-HTML media type and no no sniff header, we should raise a security warning. http://mimesniff.spec.whatwg.org/

Warn on oversized values

1

E.g., URIs, header blocks, header lines, Expires, max-age, etc. http://blogs.msdn.com/b/ieinternals/archive/2010/01/26/use-max-age-values-less-than-maxint.aspx

Detect multiple content-length headers

7

... including duplicates (warn)

Based upon common implementations (list all browsers?), configurations, plus request URI, referer, cookies.

subreq.py

i.e., no etag or lm