AI BriefingOpenAI Engineers Propose HTTP Draft to Share User Signals with Websites
·2026.11.11 09:00
Key point
The proposal adds six parameters to the Forwarded header but lacks mandatory signatures and user consent mechanisms.
Details
- Two OpenAI engineers submitted an Internet-Draft to the IETF HTTP Working Group proposing six new optional parameters for the Forwarded header: asn, ip-country, ip-prefix, locale, tz, and user-agent.
- The author argues the draft is a flawed fix because it allows agents to share user data without mandatory cryptographic signatures, making the signals vulnerable to spoofing by fraudsters.
- The proposal lacks a mechanism for websites to request specific signals or for users to give explicit consent, leaving the decision to share data entirely to the agent operator.
- Existing standards like Client Hints and the Prefer header already handle language and time zone preferences more effectively, while the Forwarded header is technically incorrect for agent-initiated requests.
- The draft ignores caching implications, where shared user signals could cause incorrect content delivery to subsequent users, and raises GDPR concerns regarding the disclosure of personal data like masked IPs and time zones.
This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.
Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.
Related
Nvidia Used Circular Financing to Keep GPU Prices High, WSJ Report ClaimsResearch finds 24,664 Lovable apps exposing sensitive data without login