Re: What constitutes protection [was: About using CORS]

On Wed, May 5, 2010 at 3:20 PM, Robert O'Callahan <robert@ocallahan.org> wrote:
> Referer checking has a few problems:

Indeed. And CORS is incrementally better. I'm suggesting there is a
lot of precedent of how assets and services have been managed
historically on the web, and has largely been agnostic of content
type. That said, CORS seems to be mostly used for dynamic content
(like passing JSON between domains) rather than setting permission on
static content. Even if fonts are significantly different from other
static content types, they'll still be served like those, rather than
as dynamic data.

 -j

Received on Wednesday, 5 May 2010 22:54:32 UTC