Copyright © 2008 W3C® (MIT, INRIA, Keio), All Rights Reserved. W3C liability, trademark, document use, and software licensing rules apply.
This document provides goals, requirements and usage scenarios for Access Control for Cross-site requests.
This document is an editors' copy that has no official standing.
This document has been developed for discussion by the Web Application Formats Working Group. It does not yet represent the consensus opinion of the Working Group.
Please send comments to the WAF Working Group's public mailing list public-appformats@w3.org with access-control] at the start of the subject line. Archives of this list are available. See also W3C mailing list and archive usage guidelines.
This document was produced by a group operating under the 5 February 2004 W3C Patent Policy. W3C maintains a public list of any patent disclosures made in connection with the deliverables of the group; that page also includes instructions for disclosing a patent. An individual who has actual knowledge of a patent which the individual believes contains Essential Claim(s) must disclose the information in accordance with section 6 of the W3C Patent Policy.
Publication of this document does not imply endorsement by the W3C Membership. This is a draft document and may be updated, replaced or obsoleted by other documents at any time.
Please send comments on this finding to the publicly archived TAG mailing list www-tag@w3.org (archive).
1. Goals
2. Usage Scenarios
3. Requirements
3.1 Terminology
3.2 Control in hands of server
3.3 No server software changes
3.4 Use of GET without any Scripting
3.5 Configurable on per-resource basis
3.6 Configurable without main site admin intervention
3.7 No new XSS attacks when user changes client
3.8 No new XSS attacks when author changes server
3.9 No access granted because of caching.
4. Acknowledgements
A. Change Log (Non-Normative)
A goal of the Web Applications Format Working Group is to produce a mechanism that enables the specification of access control for cross-site requests.
AC4CSR MUST leave the control in the hand of the server. Ednote: I have no idea what this means
AC4CSR MUST be implemented without changing the actual server software
AC4CSR MUST use GET to provide files for cross-domain access without scripting of any kind of the server side.
Ednote: this seems like a design rather than a requirement. I think the real requirement is an HTTP method that works with most/all server software and the problem with non-GET is apache.
AC4CSR MUST be configurable without coordination with the main site administrator
AC4CSR MUST introduce no new XSS attack vectors when a user changes client, assuming the client is conforming to the new spec