Re: Proposal: Security checks after same-origin revocation with document.domain

On Fri, 13 Apr 2012, Boris Zbarsky wrote:
> On 4/13/12 5:56 PM, Ian Hickson wrote:
> > On Fri, 13 Apr 2012, Bobby Holley wrote:
> > > 
> > > I think this is suboptimal behavior. If we value revocation enough to
> > > spec it [...]
> > 
> > I don't think we do. It's only specced because that's what browsers did,
> > and I try to spec what browsers do.
> 
> Actually, having revocation is very important in some scenarios; 
> otherwise you can't use document.domain securely at all.

Can you elaborate on that?

-- 
Ian Hickson               U+1047E                )\._.,--....,'``.    fL
http://ln.hixie.ch/       U+263A                /,   _.. \   _\  ;`._ ,.
Things that are impossible just take longer.   `._.-(,_..'--(,_..'`-.;.'

Received on Friday, 13 April 2012 22:38:43 UTC