On Wed, Apr 8, 2009 at 1:32 PM, Bil Corry <bil@corry.biz> wrote: > BTW, one reason to do this is to help deter timing attacks. Any request that arrives for the login page or a protected page that isn't same-origin can be redirected to a common landing page. This doesn't make much sense. People mount timing attacks against the login from from their own machine (where they can send whatever headers they like). AdamReceived on Thursday, 9 April 2009 04:24:03 GMT
This archive was generated by hypermail 2.2.0+W3C-0.50 : Monday, 7 December 2009 10:43:10 GMT