Re: [access-control] non-GET threat model and authorization choreography

On 2007-10-09 13:59:55 +0200, Anne van Kesteren wrote:

>   4. Store the result of an access request check in a table along
>      with a timeout time from a dedicated HTTP header. Invalidate
>      this result after the timeout time has been reached. If
>      there is no timeout time do not store the result.

> I don't think 1 is really an option. I can't really judge the feasability of 
> 2. 3 seems annoying for debugging. 4 seems relatively easy to specify and 
> can work on top of the existing HTTP cache for the URI.

How is 4 any different from saying "use HTTP caching"?  (I might
missing the point here...)

-- 
Thomas Roessler, W3C  <tlr@w3.org>