Re: Request for Comments on Enabling Read Access for Web Resources

Anne van Kesteren wrote:
>> We would then like the document to indicate whether there are
>> situations where implementation of the Read Access Control Policy
>> mechanism would make a UA and the network to which it is attached any 
>> more vulnerable to
>> attack.
>>
>> We think that the increased risk is probably small, but we believe
>> that the document should present more analysis than it does at present.
> 
> I tried making this more clear in the security section: 
> http://dev.w3.org/2006/waf/access-control/Overview.html#security

We might want to mention that implementations should not allow other 
methods than GET, and not allow the user to specify username/password or 
http-headers in conjunction with this, without taking extra precaution 
to make sure that that is safe. I.e. XHR2 will allow other methods than 
GET, but only if the server opts-in to it.

/ Jonas