W3C home > Mailing lists > Public > public-webapps@w3.org > April to June 2009

Re: XHR and sandboxed iframes (was: Re: XHR without user credentials)

From: Mark S. Miller <erights@google.com>
Date: Wed, 17 Jun 2009 17:02:04 -0700
Message-ID: <4d2fac900906171702n1ab806dl8afd32324c42bc3b@mail.gmail.com>
To: Ian Hickson <ian@hixie.ch>
Cc: Anne van Kesteren <annevk@opera.com>, Tyler Close <tyler.close@gmail.com>, Adam Barth <w3c@adambarth.com>, public-webapps <public-webapps@w3.org>
On Wed, Jun 17, 2009 at 4:46 PM, Ian Hickson <ian@hixie.ch> wrote:

> But... we want the page talking on behalf of the user. That's the point
> of a browser.


Not in this way. At least not according to Roy Fielding (Mr. REST) <
http://lists.w3.org/Archives/Public/ietf-http-wg/2009JanMar/0037.html>.


> I don't really understand what we're trying to prevent here.
>

Confused deputies such as XSRF problems. Original paper is at <
http://www.cis.upenn.edu/~KeyKOS/ConfusedDeputy.html>. It's well worth
rereading. Much deeper than it at first appears.

Perhaps my own <srl.cs.jhu.edu/pubs/SRL2003-02.pdf> may help.

The threads and links already cited should make the connection with browser
security clear.

I'm not really sure what more to explain. Perhaps you could ask a more
specific question?

-- 
   Cheers,
   --MarkM
Received on Thursday, 18 June 2009 00:02:43 GMT

This archive was generated by hypermail 2.3.1 : Tuesday, 26 March 2013 18:49:31 GMT