Re: Mailserver URL proposal

Martin Hamilton (martin@mrrl.lut.ac.uk)
Wed, 20 Jul 1994 10:57:44 +0100 (BST) 

Date: Wed, 20 Jul 1994 10:57:44 +0100 (BST)

From: Martin Hamilton <martin@mrrl.lut.ac.uk>

Subject: Re: Mailserver URL proposal

To: Dirk Herr-Hoyman <hoymand@gate.net>

In-Reply-To: <199407200133.VAA98546@inca.gate.net>


Message-Id: <Pine.3.89.9407200939.A919-0100000@envy.mrrl.lut.ac.uk>

Perhaps the security considerations section should read more like
this... ?

--
This URL is essentially a means to send electronic mail.  Since
it allows the message header to be specified, it could be a vehicle
for forged and/or nuisance mail


Consequently, before any message is sent, the user should be
presented with the contents of the headers (rendered as per RFC822)
for approval


Furthermore, implementations of the mailserver URL should ignore
the values supplied for the following headers:


  From:
  Reply-To:
  Sender:


Correct values for these fields should be generated by the user's
mail software (e.g. sendmail)

--


How does that sound?


One oher thing strikes me - the address field is ambiguous:


  URL:mailserver://president@whitehouse.gov/To:%20clinton@whitehouse.gov/...


Perhaps the mailserver spec ought to clarify which of these
takes precedence ?


Finally, is it really necessary to allow the URL to specify the
value of _any_ header ?  Perhaps we could get away with


  URL:mailserver://<rfc822-addr-spec>/<subject>/<body>


where <subject> becomes the RHS of the Subject: header, if supplied




Cheers,


Martin