[access-control] Authenticated GET requests from Anne van Kesteren on 2007-10-23 (public-appformats@w3.org from October 2007)

From: Anne van Kesteren <annevk@opera.com>
Date: Tue, 23 Oct 2007 15:50:19 +0200
To: "WAF WG (public)" <public-appformats@w3.org>
Message-ID: <op.t0nkp5vr64w2qv@annevk-t60.oslo.opera.com>

Hi,

One of our security guys is not happy with cross-site authenticated GET  
requests without some sort of verification from the server beforehand that  
it is actually ok to do that. Even though this is already possible to do  
so currently using <img> and <iframe> he thinks that practice shouldn't be  
further supported by making it mandatory for user agents to support that.  
The thought being that it might be possible to improve the situation for  
<img>/<iframe>/etc. at some point in the future. Any thoughts?

Kind regards,


-- 
Anne van Kesteren
<http://annevankesteren.nl/>
<http://www.opera.com/>

Received on Tuesday, 23 October 2007 13:50:13 UTC