WICG/webpackage

Address clients that are offline for long periods of time

Open

#117 opened on Jan 26, 2018

View on GitHub
 (3 comments) (1 reaction) (0 assignees)Go (123 forks)github user discovery
architecturefeature requesthelp wanted

Repository metrics

Stars
 (1,256 stars)
PR merge metrics
 (PR metrics pending)

Description

People with expensive data plans may run out of data early in a month, and not come back online until the next month. The 7-day validity limit in https://wicg.github.io/webpackage/draft-yasskin-http-origin-signed-responses.html#signature-validity is good or even too long while online, but not enough while offline. We need to figure out if we can give clients permission to use expired signatures under certain circumstances, and if so, how to specify that.

Contributor guide

Research direction
Investigate how to allow clients to use expired signatures when offline for long periods. Review the current 7 day validity limit in the specification and explore mechanisms like grace periods, trust on first use, or time based allowances. Examine security trade offs and propose a change to the web package specification.
Tech stack
go
Domain
backend
Issue type
Research
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
5
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GoGit
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
35