Re: Op-sec simplification from Martin Thomson on 2016-10-31 (ietf-http-wg@w3.org from October to December 2016)

From: Martin Thomson <martin.thomson@gmail.com>
Date: Tue, 1 Nov 2016 10:15:13 +1100
To: Mark Nottingham <mnot@mnot.net>
Cc: Kari Hurtta <hurtta-ietf@elmme-mailer.org>, HTTP working group mailing list <ietf-http-wg@w3.org>
Message-ID: <CABkgnnVm2roXz5BiQeh5m2a_zcsfC3rFZ2pnoQ_m9k6b3K=58w@mail.gmail.com>

On 1 November 2016 at 09:41, Mark Nottingham <mnot@mnot.net> wrote:
> Hold on -- are we layering in a new requirement to use the absolute form of the URL?

I don't know how we carry the scheme any other way.  We might try to
weasel this as being not "directly" to the origin server.

Maybe I should point out that this is in contradiction to that section.

(FWIW, the servers I'm aware of all handle absolute URIs well enough.)

Received on Monday, 31 October 2016 23:15:46 UTC