Re: HTTPbis and the Same Origin Policy

Much of this material is in fact part of the HTML5 and XMLHttpRequest specifications.


The XMLHttpRequest specification is in Last Call as of 19 November (with 16 December deadline), and it includes a specification of the same origin policy for XMLhttpRequest -- see step 13 of the open() method [1].

http://www.w3.org/TR/XMLHttpRequest/#the-open-method

I'll note that that specification lacks any security considerations at this point, and that calling out the same origin policy more prominently (and talking about DNS rebinding) sound like they would be fine and timely additions to that spec.

Additionally, I suspect that in-depth review from the HTTP Working Group would be an extremely valuable for this spec.



HTML5 defines a number of relevant policies:

  http://dev.w3.org/html5/spec/Overview.html#security
  http://dev.w3.org/html5/spec/Overview.html#security-1
  http://dev.w3.org/html5/spec/Overview.html#security-2
  http://dev.w3.org/html5/spec/Overview.html#relaxing-the-same-origin-restriction
  http://dev.w3.org/html5/spec/Overview.html#security-and-privacy-considerations
  http://dev.w3.org/html5/spec/Overview.html#security-with-canvas-elements
  
There are a few more places.  Unfortunately, the easiest way to identify all cases in which HTML5 explicitly specifies a security policy seems to be searching for the "SECURITY_ERR" exception.


Regards,
--
Thomas Roessler, W3C  <tlr@w3.org>







On 25 Nov 2009, at 16:39, Tyler Close wrote:

> AFAICT, HTTPbis says nothing about the Same Origin Policy (SOP), yet
> this policy is a major constraint on the behavior of many HTTP user
> agents, restricting what HTTP requests can be sent and what HTTP
> responses can be delivered. SOP is not defined by any standard. Should
> HTTPbis step up?
> 
> --Tyler
> 
> -- 
> "Waterken News: Capability security on the Web"
> http://waterken.sourceforge.net/recent.html
> 
>

Received on Wednesday, 25 November 2009 17:46:30 UTC