[CORS] Multiple origin values?

• From: Vladimir Dzhuvinov <vladimir@dzhuvinov.com>
• Date: Fri, 24 Sep 2010 17:31:52 +0300
• To: public-webapps <public-webapps@w3.org>
• Message-ID: <AANLkTi=iuoQQMwxXSa-1U8+S-_WZSNMUm=v6JV3_Y0e_@mail.gmail.com>

Another question regarding the CORS spec:

1. Why would a browser report multiple Origins to the web server?

2. http://www.w3.org/TR/access-control/#resource-requests  Why does
the spec prescribe "match any" instead of "match all" when multiple
origin values are received? Shouldn't the server app determine whether
AND or OR matching is more appropriate?


Vladimir

-- 
Vladimir Dzhuvinov :: software.dzhuvinov.com

Received on Friday, 24 September 2010 14:32:25 UTC