Re: XDomainRequest Integration with AC

On Jul 18, 2008, at 4:20 PM, Sunava Dutta wrote:

> I’m in time pressure to lock down the header names for Beta 2 to  
> integrate XDR with AC. It seems no body has objected to Jonas’s  
> proposal. http://lists.w3.org/Archives/Public/public-webapps/2008JulSep/0175.html
> Please let me know if this discussion is closed so we can make the  
> change.

I think Anne's email represents the most recent agreement and I don't  
think anyone has objected: http://lists.w3.org/Archives/Public/public-webapps/2008JulSep/0142.html

The change would be:

Instead of checking for "XDomainRequestAllowed: 1" check for "Access- 
Control-Allow-Origin: *" or "Access-Control-Allow-Origin: url" where  
url matches what was sent in the Origin header.

Regards,
Maciej



>
> Namely,
> The changes to support the new Access control model is as follows –
>
> ·         Change Referer header set in the request to Origin.
> ·         Change the XDomainRequestAllowed header check from it  
> being “1” to check for Access-Control: allow <*>
>
> In addition, I realized that the discussions we had in the F2F  
> (tracked by issue 32http://www.w3.org/2008/webapps/track/issues/32)  
> means that an access control check is now also performed when the  
> redirect steps are applied to prevent data leakage from intranet  
> pages. This is different from XDR as we currently do the check in  
> the final destination for redirection. I think the reason why we did  
> this in XDR was to allow cross domain resources to move around  
> easily. That said, I’m not religious about this issue either way.  
> (Adding my team-mates to hear if they have any concerns).  I’ll ask  
> our dev to make the change, but before that I just wanted to confirm  
> the AC spec will be updated with this. Currently I couldn’t find  
> this in the updated spec but I could be wrong.
> Thanks,