Re: Linked Data Profile and CORS

On 18 Jul 2012, at 21:21, Melvin Carvalho wrote:

> 
> 
> On 17 July 2012 11:13, Henry Story <henry.story@bblfish.net> wrote:
> Hi,
> 
>   [I sent the following mail to the Linked Data Profile WG, to see if it is something they are able to add to their topics of interest (that may take some time, and so should not stop us looking into it too).]
> 
>   I think as mentioned previously LDP does require some form of authentication, as it allows non-idempotent methods such as POST, PUT & DELETE . This means that there will be some interesting things to think about relating to CORS [1]
> 
> Good questions!
> 
> PUT GET and DELETE are idempotent, POST is not.

Ah. yes, thanks for the correction. 


>  
> 
>   One application of an LDP server would be to have a javascript client [2] be able to crawl RDF linked data in order to build up a user interface. I have a really simple example that kind-of™ works.
> 
>   http://bblfish.github.com/rdflib.js/example/people/social_book.html
> 
>  The page contains no data just a reference to my foaf profile, which is how it fills in the user info and the first column of the Social Book. If you click on some users, such as "Joe Presbrey" the javascript will make an XHR request to his WebID Profile http://presbrey.mit.edu/foaf, which since it contains the right headers especially the "Access-Control-Allow-Origin: *"
> 
> $ curl -I http://presbrey.mit.edu/foaf
>   HTTP/1.1 200 OK
>   Date: Tue, 17 Jul 2012 08:35:03 GMT
>   Server: Apache
>   Access-Control-Allow-Origin: *
>   Last-Modified: Tue, 20 Dec 2011 01:02:36 GMT
>   ETag: "43c4058c-1437-4b47b9f740300"
>   Accept-Ranges: bytes
>   Content-Length: 5175
>   Content-Type: application/rdf+xml
> 
> the browser is authorised to pass that profile on for use by the javascript that will display the info. Most linked data sites do not put such headers up, and so make it necessary then to develop CORS proxies (which that social_book application also uses).
> 
>  It may be worth exploring this side of things a bit. Perhaps adding to the LDP Use Cases [3] a javascript based linked data browser could bring these issues up in the LDP Working Group.
> 
> Some questions that come up from my little experience in this area are:
>  - should all public RDF resources always return Access-Control-Allow-Origin: * to all public resources?
>    ( I would tend to think so, because a simple proxy will always give access to that resource anyway )
>  - How does a server know which Origin JS agents to trust for a particular user? Since we are are working in a linked data environment that at its best spans many organisations how is the IBM linked data provider to know that it should trust my bblfish.net JS Agent to get a particular resource for me?
>    (my suggestions if I add :me cert:trustOrigin <https://bblfish.net> to my WebID profile? )
>  - what types of improvements to the identity of JS applications might in the long term help develop better apps? ( perhaps having signed JS apps? )
> 
>  Henry
> 
> 
> [1] http://www.w3.org/TR/cors/
> [2] as done by Tabulator or the rdflib.js library published on github
>    https://github.com/linkeddata/
> [3] http://www.w3.org/2012/ldp/wiki/Use_Cases_And_Requirements
> 
> Social Web Architect
> http://bblfish.net/
> 
> 
> 

Social Web Architect
http://bblfish.net/