Jonas Sicking wrote: > > mike amundsen wrote: >> I agree w/ Kris: >> >> Limiting HTTP headers is a real problem. I see no reason for this. >> Certainly not for security reasons. > > How can you know that it is safe to send any header to any server? > Note that no access checks are done before sending GET requests, so > allowing any header there seems like it has great potential to have > undesired effects on servers. > Note that modifying operations (POST, DELETE, etc.) do have an access check performed before execution. If nothing else is changed, could the spec be modified so that it allowed all headers for such operations?Received on Tuesday, 19 February 2008 03:07:10 GMT
This archive was generated by hypermail 2.2.0+W3C-0.50 : Tuesday, 19 February 2008 03:07:11 GMT