Re: The HTTP Sec-From Header (draft-abarth-origin)

On Tue, Oct 27, 2009 at 4:15 PM, =JeffH <Jeff.Hodges@kingsmountain.com> wrote:
> draft-abarth-origin-05  features this ABNF..
>
>     origin            = "origin" ":" OWS [ "null" / origin-list ] OWS
>     origin-list       = serialized-origin *( 1*SP serialized-origin )
>     serialized-origin = scheme "://" host [ ":" port ]
>      ; <scheme>, <host>, <port> productions from RFC3986
>
> ..with provisio that it is "...ABNF [RFC5234] grammar..."
>
> However, I cannot find the production for <OWS> in either
> draft-abarth-origin-05 or  [RFC5234].

I have no idea what it means.  That's what Julian Reschke told me to
put there.  We're not trying to be innovative.  We're just trying to
spec a normal HTTP header.  It's kind of annoying that it's this
tricky

> Also, why is serialized-origin delimited explicitly by spaces ( 1*SP ) and
> not simply whitespace e.g. 1*WSP ?  where <WSP> is from [RFC5234]..
>
>         WSP            =  SP / HTAB
>                                ; white space
>
> ?

The latest version (which I might not have uploaded yet) actually just
specs SP.  That's what Anne wanted.  We're going to talk about this
issue at TPAC and figure out what delimiter we want to use here.  The
other option Anne is considering is a comma, as requested by mnot.  My
understanding is there are some subtleties in CORS at play.

Adam