[apps-discuss] web origins and URIs

"Thomson, Martin" <Martin.Thomson@andrew.com> Mon, 15 November 2010 03:32 UTC

Return-Path: <Martin.Thomson@andrew.com>
X-Original-To: apps-discuss@core3.amsl.com
Delivered-To: apps-discuss@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9CDE63A6C2B for <apps-discuss@core3.amsl.com>; Sun, 14 Nov 2010 19:32:48 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.823
X-Spam-Level:
X-Spam-Status: No, score=-1.823 tagged_above=-999 required=5 tests=[AWL=-1.084, BAYES_20=-0.74, WEIRD_PORT=0.001]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Yy9mLRnT2IIH for <apps-discuss@core3.amsl.com>; Sun, 14 Nov 2010 19:32:48 -0800 (PST)
Received: from csmailgw1.commscope.com (csmailgw1.commscope.com [198.135.207.244]) by core3.amsl.com (Postfix) with ESMTP id D511D3A6A20 for <apps-discuss@ietf.org>; Sun, 14 Nov 2010 19:32:47 -0800 (PST)
Received: from [10.86.20.102] ([10.86.20.102]:49197 "EHLO ACDCE7HC1.commscope.com") by csmailgw1.commscope.com with ESMTP id S38417260Ab0KODd1 (ORCPT <rfc822; apps-discuss@ietf.org>); Sun, 14 Nov 2010 21:33:27 -0600
Received: from SISPE7HC2.commscope.com (10.97.4.13) by ACDCE7HC1.commscope.com (10.86.20.102) with Microsoft SMTP Server (TLS) id 8.1.436.0; Sun, 14 Nov 2010 21:33:27 -0600
Received: from SISPE7MB1.commscope.com ([fe80::9d82:a492:85e3:a293]) by SISPE7HC2.commscope.com ([fe80::58c3:2447:f977:57c3%10]) with mapi; Mon, 15 Nov 2010 11:33:24 +0800
From: "Thomson, Martin" <Martin.Thomson@andrew.com>
To: "ietf@adambarth.com" <ietf@adambarth.com>
Date: Mon, 15 Nov 2010 11:33:21 +0800
Thread-Topic: web origins and URIs
Thread-Index: AcuEddon2CLs3B4bRrCCoilE/zrGiQ==
Message-ID: <8B0A9FCBB9832F43971E38010638454F03F33EA089@SISPE7MB1.commscope.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: en-US
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-BCN: Meridius 1000 Version 3.4 on csmailgw1.commscope.com
X-BCN-Sender: Martin.Thomson@andrew.com
Cc: Discuss Apps IETF <apps-discuss@ietf.org>
Subject: [apps-discuss] web origins and URIs
X-BeenThere: apps-discuss@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: General discussion of application-layer protocols <apps-discuss.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/apps-discuss>, <mailto:apps-discuss-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/apps-discuss>
List-Post: <mailto:apps-discuss@ietf.org>
List-Help: <mailto:apps-discuss-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/apps-discuss>, <mailto:apps-discuss-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 15 Nov 2010 03:32:48 -0000

Hi Adam,

Looking at a discussion on origins today, my MTA decided to interpret all origins as URIs.

Obviously, this is not an intentional outcome.  As I read it, the intent is to extract a character sequence from a URI/IRI that is compared with other such character sequences for a variety of purposes (though mostly related to the same-origin policy in browsers).

Though an origin might take the form of a valid URI, it is not a URI.  This might lead to misinterpretation.

I'll admit that the effect (for HTTP at least) is unlikely to be severe, but it should be possible to avoid this altogether.  Why not define a new URI scheme for this purpose?

   origin:https://www.example.com:8443

Most apps wont care about the prefix, but when these leak out of their usage context, they are less likely to be misinterpreted if they are prefixed in this fashion.  (My MTA doesn't misinterpret the above, though others might still.)

--Martin