Re: [UMP] Subsetting (was: [XHR2] AnonXMLHttpRequest())

On Mon, Apr 12, 2010 at 3:41 PM, Jonas Sicking <jonas@sicking.cc> wrote:
> On Mon, Apr 12, 2010 at 3:10 PM, Tyler Close <tyler.close@gmail.com> wrote:
>>> I think even taken together, your set of subset conditions does guarantee
>>> that a CORS client implementation is automatically also a UMP client
>>> implementation. If we went that way, then we would have to consider whether
>>> there will ever be client implementors of UMP itself, or it will be
>>> impossible to fulfill CR exit criteria.
>>
>> If there are implementers of CORS, then by definition, there are
>> implementers of UMP. I don't see anything in CR exit criteria that
>> requires implementers to swear not to also implement other
>> specifications.
>
> So is sending the 'Origin' and 'Referer' headers ok per UMP?

Sending "Origin: null" is OK per UMP. Similarly, an "null"-like value
for Referer would be OK.

> The current CORS implementation in firefox always sends those headers.

Then that implementation is only compatible with UMP when used in
combination with some mechanism for putting the requesting content in
an anonymous <iframe>. Ideally, Firefox would allow this to be
expressed via the messaging API instead of requiring the anonymous
<iframe>.

> I would have imagined that UMP would explicitly forbid any ambient
> authority or identity information other than IP number?

Correct.

--Tyler

-- 
"Waterken News: Capability security on the Web"
http://waterken.sourceforge.net/recent.html

Received on Monday, 12 April 2010 22:48:59 UTC