[webappsec] "certificates differ" text in CORS

Hat="individual"

In the CORS spec, it currently states that the UA may terminate the algorithm if, e.g. "certificates differ".  I've fielded questions about this, and some investigation seems to have uncovered that this was intended to cover the case where a different certificate might be presented between the pre-flight request and actual request.  However, this is normal behavior for the web PKI, and I don't think it should be a reason to terminate, so long as both certificates are valid.

I think a clarification and better statement of proper behavior would be if "an invalid certificate is presented".  Since certificate warning dialogs are already extremely problematic for users even when they have the URL bar to compare against, an invalid certificate in a cross-domain context is probably impossible for most users to make a meaningful trust decision about and should simply result in a termination of the algorithm.

Thoughts?

Brad Hill