W3C home > Mailing lists > Public > public-webapps@w3.org > April to June 2010

Re: CORS Last Call status/plans? [Was: Re: [UMP] Request for Last Call]

From: Maciej Stachowiak <mjs@apple.com>
Date: Mon, 19 Apr 2010 00:27:18 -0700
Cc: Ben Laurie <benl@google.com>, Tyler Close <tyler.close@gmail.com>, Arthur Barstow <Art.Barstow@nokia.com>, ext Anne van Kesteren <annevk@opera.com>, public-webapps <public-webapps@w3.org>
Message-id: <A6E8539F-1C98-4255-A087-2BF405E90E43@apple.com>
To: Julian Reschke <julian.reschke@gmx.de>

On Apr 18, 2010, at 9:56 AM, Julian Reschke wrote:

> On 18.04.2010 14:35, Ben Laurie wrote:
>>    In general, whitelists are bad because they close extension  
>> points.
>>    Please consider using a black list instead.
>>
>>
>> In general, blacklists are bad because they open security holes.
>
> My experience is that people work around white lists by tunneling  
> information through the parts they are allowed to use. That doesn't  
> help at all, because it makes detecting and blocking the bad stuff  
> even harder (example: tunneling other HTTP methods through POST  
> using a "method override" request header).

The security concern would be about accidental exposure, not  
deliberate tunneling of additional info. It's fine for two cooperating  
parties to send each other more information on purpose.

Regards,
Maciej
Received on Monday, 19 April 2010 07:27:53 GMT

This archive was generated by hypermail 2.3.1 : Tuesday, 26 March 2013 18:49:38 GMT