Re: UMP / CORS: Implementor Interest

On Tue, Apr 20, 2010 at 11:36 AM, Jonas Sicking <jonas@sicking.cc> wrote:
> On Tue, Apr 20, 2010 at 9:27 AM, Tyler Close <tyler.close@gmail.com> wrote:
>> On Mon, Apr 19, 2010 at 6:47 PM, Anne van Kesteren <annevk@opera.com> wrote:
>>> On Tue, 20 Apr 2010 00:38:54 +0900, Jonas Sicking <jonas@sicking.cc> wrote:
>>>>
>>>> As I've said before. I'd be interested in implementing UMP in firefox
>>>> if we can come  up with a reasonable API for using it. I.e. a separate
>>>> constructor or flag or similar on XHR. This is assuming that UMP is a
>>>> reasonable subset of CORS.
>>>
>>> Have you looked at the proposal I put in XHR2? It sets certain flags in CORS
>>> that make it more or less the same as UMP.
>>
>> Why can't it be made exactly like UMP? All of the requirements in UMP
>> have been discussed at length and in great detail on this list by some
>> highly qualified people. The current UMP spec reflects all of that
>> discussion. By your own admission, the CORS spec has not received the
>> same level of review for these features. Why hasn't CORS adopted the
>> UMP solution?
>
> Would you be fine with "folding" UMP into CORS if more of the wording
> from UMP is used in the CORS spec?
>
> Are the differences only editorial or are there different header
> names/values as well?

The differences are not only editorial. The problem is missing MUST
statements in the CORS spec, governing what the user-agent does. The
on-the-wire parts are nearly identical. The header names and values
are consistent (or will be once CORS response header filtering is
fixed).

Ideally, I'd like UMP to be folded into CORS by reference rather than
by value, since there are major outstanding issues against CORS that
don't affect UMP.

--Tyler

-- 
"Waterken News: Capability security on the Web"
http://waterken.sourceforge.net/recent.html

Received on Tuesday, 20 April 2010 20:01:22 UTC