[Bug 11203] Canvas security model does not allow for same-origin relaxation


--- Comment #9 from Matt Schemmel <matt.schemmel@gmail.com> 2010-11-03 22:38:11 UTC ---
Normally I'd slightly disagree with you there, so long as A and B are part of
the same parent domain.

Definitely haven't thought through the repercussions in an EC2 age, though, so
I'll defer to those that have :)

The biggest concern that I have with the CORS approach is that it seems like it
depends on the UAs to properly set up the Origin header on the request, which I
don't believe is generally the case today. (We're really not looking to "*" out
the credentialing, though I guess that could be a workaround).

Am I reading the CORS spec right in that cookies can be passed with the
request, just that UAs are expected to disregard any modifications that come by
way of Set-Cookie in the response?

Configure bugmail: http://www.w3.org/Bugs/Public/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.

Received on Wednesday, 3 November 2010 22:38:13 UTC