Re: What constitutes protection [was: About using CORS]

On Tue, May 4, 2010 at 2:01 PM, Levantovsky, Vladimir
<Vladimir.Levantovsky@monotypeimaging.com> wrote:
> On Tuesday, May 04, 2010 2:26 AM Anne van Kesteren wrote:
>>
>> On Tue, 04 May 2010 15:12:49 +0900, Robert O'Callahan
>> <robert@ocallahan.org> wrote:
>> > Yes, there was a big kerfuffle over video. A few reasons why video is
>> > probably different from fonts:
>> > a) video is huge, so much more likely to need CDN support or at least
>> to
>> > be placed on dedicated servers. Fonts are much smaller so it's
>> generally
>> > going to be easy to serve a font on the same server as the rest of
>> the
>> > normal page content.
>>
>> I just checked cnn.com and it seems to be using CDN for style sheets.
>> If
>> it is using them for style sheets it seems likely it would use them for
>> fonts too, as they are typically larger than style sheets.
>>
>
> Can you please elaborate a bit more on this whole issue? It seems that CDN should be completely transparent for UA, and that content and resources such as CSS and fonts would appear to a browser as coming from the same origin it was requested, regardless of whether CDN is used or not. So, if content is in fact comes from CDN - how does it affect same-origin restriction?
>

If you go to 'www.cnn.com', the CSS files are served from
'i.cdn.turner.com', which is a CDN (presumably) on a different origin
than the requesting page. This type of usage is extremely common,
because the CDN gets a different (usually smaller) set of cookies than
the origin server (and hence the requests are usually received
faster).

-- Dirk

Received on Wednesday, 5 May 2010 01:36:12 UTC