Re: [access-control] non-GET threat model and authorization choreography

Use a well-known location, like robots.txt, site maps, P3P and pretty  
much every other site-wide metadata mechanism does things.

Yes, it's ugly, yes it reserves part of URI space, and yes, it's not  
terribly friendly to micro-sites. However, it is well-understood on  
all sides, is widely deployed, scales well for complex interactions  
with multiple resources, and is less likely to have surprises pop up.

If the TAG or somebody else comes up with something genuinely better,  
great, but people have been working on it for a long time without  
much luck.

Cheers,


On 2007/10/12, at 7:43 PM, Anne van Kesteren wrote:

> On Fri, 12 Oct 2007 06:16:16 +0200, Mark Nottingham <mnot@yahoo- 
> inc.com> wrote:
>> You're forgetting...
>>
>> 5. Use a different URI.
>
> How would that work?
>
>
> -- 
> Anne van Kesteren
> <http://annevankesteren.nl/>
> <http://www.opera.com/>

--
Mark Nottingham       mnot@yahoo-inc.com

Received on Friday, 12 October 2007 11:52:18 UTC