W3C home > Mailing lists > Public > ietf-http-wg@w3.org > October to December 2009

Re: The HTTP Sec-From Header (draft-abarth-origin)

From: Adam Barth <w3c@adambarth.com>
Date: Tue, 27 Oct 2009 20:19:33 -0700
Message-ID: <7789133a0910272019v30052305nb5f90dae1ebe962e@mail.gmail.com>
To: "=JeffH" <Jeff.Hodges@kingsmountain.com>
Cc: HTTP Working Group <ietf-http-wg@w3.org>, Julian Reschke <julian.reschke@gmx.de>
On Tue, Oct 27, 2009 at 4:15 PM, =JeffH <Jeff.Hodges@kingsmountain.com> wrote:
> draft-abarth-origin-05  features this ABNF..
>
>     origin            = "origin" ":" OWS [ "null" / origin-list ] OWS
>     origin-list       = serialized-origin *( 1*SP serialized-origin )
>     serialized-origin = scheme "://" host [ ":" port ]
>      ; <scheme>, <host>, <port> productions from RFC3986
>
> ..with provisio that it is "...ABNF [RFC5234] grammar..."
>
> However, I cannot find the production for <OWS> in either
> draft-abarth-origin-05 or  [RFC5234].

I have no idea what it means.  That's what Julian Reschke told me to
put there.  We're not trying to be innovative.  We're just trying to
spec a normal HTTP header.  It's kind of annoying that it's this
tricky

> Also, why is serialized-origin delimited explicitly by spaces ( 1*SP ) and
> not simply whitespace e.g. 1*WSP ?  where <WSP> is from [RFC5234]..
>
>         WSP            =  SP / HTAB
>                                ; white space
>
> ?

The latest version (which I might not have uploaded yet) actually just
specs SP.  That's what Anne wanted.  We're going to talk about this
issue at TPAC and figure out what delimiter we want to use here.  The
other option Anne is considering is a comma, as requested by mnot.  My
understanding is there are some subtleties in CORS at play.

Adam
Received on Wednesday, 28 October 2009 03:20:25 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Friday, 27 April 2012 06:51:13 GMT