W3C home > Mailing lists > Public > public-webapps@w3.org > April to June 2009

Re: XHR without user credentials

From: Adam Barth <w3c@adambarth.com>
Date: Tue, 9 Jun 2009 00:22:53 -0700
Message-ID: <7789133a0906090022t6f3572c5xd275582fb9da9f13@mail.gmail.com>
To: "Mark S. Miller" <erights@google.com>
Cc: Anne van Kesteren <annevk@opera.com>, Tyler Close <tyler.close@gmail.com>, public-webapps <public-webapps@w3.org>
On Mon, Jun 8, 2009 at 5:59 PM, Mark S. Miller<erights@google.com> wrote:
> For concreteness, for the Origin header for these requests, I'll start with
> the simplest proposal that meets my goals: no Origin header for either same
> origin requests or cross origin requests. But for both the same origin case
> and the cross origin case, I am actually indifferent between no Origin
> header and an "Origin: null" header. If there's a reason for the "Origin:
> null" header, I'm happy with that.

Please send "Origin: null" in these cases.  The problem with omitting
the origin header is that the server can't tell if the request comes
from a legacy client or if the header was removed in transit.

Also, the Referer header should be on your hit-list as a credential.  :)

Received on Tuesday, 9 June 2009 07:23:49 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 18:12:54 UTC