Re: [apps-discuss] WebFinger Draft Updated - draft-ietf-appsawg-webfinger-01

[Christian Weiske <[e-mail]>]

Hello Paul,


>> *	Section 7 makes support for CORS a MUST and then turns
>> around and said if you have a good reason not to support it, you
>> SHOULD NOT. I suggest that support for CORS should just be a SHOULD.
>> I can figure out myself whether I want to be the exception.
> PEJ: You're entirely right about that and that text bugged me, too.
> There was a strong desire for CORS to the point I was asked to make
> it a MUST, yet there was the desire to allow an enterprise do
> something more restrictive. I have no strong preference, myself, but
> I do think that if we make it a SHOULD, though, that it will make it
> impossible to build a client in a browser.  What does the group want
> here?

Not supporting CORS does not make the data any more secure. If someone
wants security for their intranet, they have to implement real security
measurements, e.g. based on IP whitelists.

Please leave CORS support a MUST.

-- 
Regards/Mit freundlichen Grüßen
Christian Weiske

-=≡ Geeking around in the name of science since 1982 ≡=-