- From: Close, Tyler J. <tyler.close@hp.com>
- Date: Thu, 7 Feb 2008 23:20:19 +0000
- To: Ian Hickson <ian@hixie.ch>
- CC: Jonas Sicking <jonas@sicking.cc>, "WAF WG (public)" <public-appformats@w3.org>
Tyler Close wrote: > Ian Hickson wrote: > > > That's the new part. > > > > Referer-Root is not new. It's a subset of an existing header. > > The content of Referer-Root is a subset of Referer; however, > the conditions under which an honest client sends > Referer-Root are different. Today, an honest, correctly > implemented browser won't send a cross-domain POST of XML > content. Consequently, it is not convincing for a dishonest > client to use the Referer header to claim that a web page > from another site originated such a request. The same is not > true of the Referer header. The Referer header can be used to > convincingly blame another site for a request. The last two "Referer header" should be "Referer-Root" header: The same is not true of the Referer-Root header. The Referer-Root header can be used to convincingly blame another site for a request. --Tyler
Received on Thursday, 7 February 2008 23:21:25 UTC