Re: [XHR] Authorization header

On 01.04.2009, at 13:49, Anne van Kesteren wrote:

> Consistency with cross-origin requests where they need to be blocked  
> to prevent distributed dictionary attacks. I actually thought Opera  
> already blocked this header and the next Firefox release will do so  
> as well.


According to <http://mxr.mozilla.org/mozilla-central/source/content/base/src/nsXMLHttpRequest.cpp#2903 
 > and my testing, Firefox doesn't block it.

As there seems to be no danger in allowing this header for same origin  
requests, I'd suggest removing it from the list of forbidden headers.  
As mentioned in this thread, there are valid reasons to control it  
explicitly.

- WBR, Alexey Proskuryakov