Subject: [Unbearable] sec-token-binding header in the wild

From: =JeffH <[email-masked]>
Date: Wed, 15 Feb 2017 13:12:23 -0800

fyi/fwiw...

target: https://www.chromium.org/

sec-token-binding:AIkAAgBBQMaFRvLPy1uUBZer64ZluK8oBJ8kpcnO84kmCX29demwilh57_4gqlqRLBcZ_dh8x9KdN6TQQZWciZlGmhZp3sUAQFWhQBmwYSLGqlQ59KCOsYpn7Ex1dB_L5bAUTdEjd98Y5CY7NY6aczxi2gC7I6xEMAC4tONGdNOjoALTLt72REUAAA

I used the built-in chrome developer tools to examine the request 
headers and obtain the above STB

[ innarestingly enuff, if one targets https://www.google.com/, it seems 
developer tools only displays the below...

Provisional headers are shown
Referer:https://www.google.com/
User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) 
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
]

---

From: John Bradley <[email-masked]>
Date: Wed, 15 Feb 2017 20:29:13 -0300

Strange I see them on both sites with Edge.

With chrome on osx and windows I am not seeing them after turning on the flag and restarting.

I don’t know if the header capture is messing with it somehow.

Google.cl negotiated TB with Edge.

John B.

> On Feb 15, 2017, at 6:12 PM, =JeffH <[email-masked]> wrote:
> 
> fyi/fwiw...
> 
> I used the built-in chrome developer tools to examine the request headers and obtain the above STB
> 
> 
> [ innarestingly enuff, if one targets https://www.google.com/, it seems developer tools only displays the below...
> 
> User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
> ]
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> _______________________________________________
> Unbearable mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/unbearable

---

From: Nick Harper <[email-masked]>
Date: Wed, 15 Feb 2017 15:36:44 -0800

I see the sec-token-binding header for both www.google.com and
www.chromium.org from chrome on os x (version 56.0.2924.87).

On Wed, Feb 15, 2017 at 3:29 PM, John Bradley <[email-masked]> wrote:

> > sec-token-binding:AIkAAgBBQMaFRvLPy1uUBZer64ZluK
> 8oBJ8kpcnO84kmCX29demwilh57_4gqlqRLBcZ_dh8x9KdN6TQQZWciZlGmhZp3sUAQFW
> hQBmwYSLGqlQ59KCOsYpn7Ex1dB_L5bAUTdEjd98Y5CY7NY6aczxi2gC7I
> 6xEMAC4tONGdNOjoALTLt72REUAAA
> >

---

From: John Bradley <[email-masked]>
Date: Wed, 15 Feb 2017 20:46:43 -0300

I tried 56.0.2924.87 and 58.0.3013.0 OSX  and 58,0,3007 (ChromeOS) with no luck.

It might be the extension to capture headers that is messing me up.

What are you using.  I used the HTTP trace extension.

John B.

> On Feb 15, 2017, at 8:36 PM, Nick Harper <[email-masked]> wrote:
> 
> I see the sec-token-binding header for both www.google.com <http://www.google.com/> and www.chromium.org <http://www.chromium.org/> from chrome on os x (version 56.0.2924.87).
> 
> On Wed, Feb 15, 2017 at 3:29 PM, John Bradley <[email-masked] <mailto:[email-masked]>> wrote:
> > target: https://www.chromium.org/ <https://www.chromium.org/>
> >
> > [ innarestingly enuff, if one targets https://www.google.com/ <https://www.google.com/>, it seems developer tools only displays the below...
> >
> > Referer:https://www.google.com/ <https://www.google.com/>
> > [email-masked] <mailto:[email-masked]>
> > https://www.ietf.org/mailman/listinfo/unbearable <https://www.ietf.org/mailman/listinfo/unbearable>
> 
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/unbearable <https://www.ietf.org/mailman/listinfo/unbearable>
> 
>

---

From: Nick Harper <[email-masked]>
Date: Wed, 15 Feb 2017 15:49:58 -0800

I'm using the network tab of chrome's built-in dev tools to view the
headers (Ctrl+Shift+I, or kebab menu > more tools > developer tools). As
long as the flag is flipped in chrome://flags, it should be negotiating
token binding, but I don't know how that extension might be interfering.

On Wed, Feb 15, 2017 at 3:46 PM, John Bradley <[email-masked]> wrote:

>> > sec-token-binding:AIkAAgBBQMaFRvLPy1uUBZer64ZluK8oBJ8kpcnO84
>> kmCX29demwilh57_4gqlqRLBcZ_dh8x9KdN6TQQZWciZlGmhZp3sUAQFWhQB
>> mwYSLGqlQ59KCOsYpn7Ex1dB_L5bAUTdEjd98Y5CY7NY6aczxi2gC7I6xEMA
>> C4tONGdNOjoALTLt72REUAAA
>> >
>> > [ innarestingly enuff, if one targets https://www.google.com/, it
>> seems developer tools only displays the below...
>> >

---

From: John Bradley <[email-masked]>
Date: Wed, 15 Feb 2017 20:55:50 -0300

Yes I see it.   The extension must have been filtering out those headers.  

I can’t explain what Jeff is seeing.

John B.
> On Feb 15, 2017, at 8:49 PM, Nick Harper <[email-masked]> wrote:
> 
> I'm using the network tab of chrome's built-in dev tools to view the headers (Ctrl+Shift+I, or kebab menu > more tools > developer tools). As long as the flag is flipped in chrome://flags, it should be negotiating token binding, but I don't know how that extension might be interfering.
> 
> On Wed, Feb 15, 2017 at 3:46 PM, John Bradley <[email-masked] <mailto:[email-masked]>> wrote:
>> On Feb 15, 2017, at 8:36 PM, Nick Harper <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> > On Feb 15, 2017, at 6:12 PM, =JeffH <[email-masked] <mailto:[email-masked]>> wrote:
>> >
>> > fyi/fwiw...
>> >

---

From: Nick Harper <[email-masked]>
Date: Wed, 15 Feb 2017 15:58:27 -0800

I've occasionally seen the "Provisional headers are shown" message - I
think that comes up if the request is served from cache, in which case it
makes sense that there's no sec-token-binding header since there was no
request that went to a server.