Re: The HTTP Origin Header (draft-abarth-origin) from Roy T. Fielding on 2009-01-23 (ietf-http-wg@w3.org from January to March 2009)

From: Roy T. Fielding <fielding@gbiv.com>
Date: Thu, 22 Jan 2009 17:16:21 -0800
To: Mark Nottingham <mnot@mnot.net>
Cc: Larry Masinter <LMM@acm.org>, <ietf-http-wg@w3.org>, "'Lisa Dusseault'" <ldusseault@commerce.net>
Message-Id: <23F5B011-DD05-43DC-A69C-F20763BC8FD4@gbiv.com>

On Jan 22, 2009, at 4:55 PM, Mark Nottingham wrote:

> Ah, I missed the clause "where it is currently not set at all."
>
> Why would even that change be necessary? AIUI browsers sent no  
> value when the request wasn't sourced from a particular HTTP URI;  
> that's information that's valuable to the server (as Adrien points  
> out).

Er, right, I should have limited it to the https case where
nothing is sent for (what I've always considered bogus)
privacy reasons.

....Roy

Received on Friday, 23 January 2009 01:16:59 UTC