Re: Same-origin policies (Re: The other party in all this)

On Tue, Jul 7, 2009 at 5:44 AM, Bert Bos<bert@w3.org> wrote:
> "Ownership" isn't exactly the word I'm looking for, but the adoption of CORS
> to express licenses implies that the author of http://example.com/A  has a
> certain right over http://example.com/B (or vice versa, depending on which
> links to which).

As far as the license issues go, I'd say it only implies that this is
likely to be the case often enough to make it harder to hotlink fonts
in practice, so as to appease some of the font foundries.  Of course,
Mozilla requires same-origin restrictions anyway, partly for security.

> The Web architecture document[1] says that such inferences from URLs should
> not be made. Two URLs are either the same or different. There is nothing in
> between.
>
> [1] http://www.w3.org/TR/2004/REC-webarch-20041215/#uri-opacity

This is contradicted by same-origin restrictions in JavaScript and so
on, then, isn't it?  And by the design of cookies, and many HTML 5
features, etc.?

Received on Tuesday, 7 July 2009 13:48:57 UTC