[whatwg] validate attribute in <A>

[Adam Barth]

On Nov 3, 2007 2:31 AM, Ian Hickson <ian at hixie.ch> wrote:
> On Wed, 25 Jan 2006, Mike Hoye wrote:
> > The validate attribute would describe an algorithm to employ and a
> > result to compare it to; for example, somebody downloading the en-US
> > version of FF 1.5 from the Mozilla.com homepage could click on a link
> > like
> >
> > <a href="http://foo.com/mozilla-i686.tgz"
> >    validate="{md5}b63fcdf4863e59c93d2a29df853b6046">
> >
> > and the client could verify as it comes in that it does at least have
> > the md5sum that's advertised.  User notifications could include "no
> > validation", "successfully validated" and "failed validation", and act
> > according to the user's wishes in each case.
>
> It's not entirely clear to me what problem this is solving; but wouldn't
> content-MD5 (RFC 1864) be a better solution?

One scenario where something like this would be useful is for a site
like eBay that serves iframes and img tags pointing to third-party
content after reviewing that content for malware, scams, and adult
content.  Without this mechanism, the content they review might change
between the time they review it and the time their users load it.

By specifying the hash of the content, they can ensure that the user
agent loads exactly the content they reviewed.  (Of course, by
ensuring that the content specifies the hashes of all content it
loads, eBay can review all the content loaded by the iframe.)  Their
alternative is to host all the content themselves, but this would
require a large investment in server capacity as they reference a
great deal of outside content in their item listings.

Adam