Re: [hybi] #3: Origin-based security model

["hybi issue tracker" <[e-mail]>]

#3: Origin-based security model
-------------------------------------------+--------------------------------
 Reporter:  salvatore.loreto@…             |       Owner:     
     Type:  task                           |      Status:  new
 Priority:  minor                          |   Milestone:     
Component:  websocket-requirements         |     Version:     
 Severity:  -                              |    Keywords:     
-------------------------------------------+--------------------------------

Comment(by ietf@…):

 I think you have the dependencies backwards.  XMLHttpRequest and
 WebSockets define a policy by referencing the algorithms in that document.
 The same-origin policy varies by API so it's not possible to write a once-
 and-for-all document that explains it.

 As an example, the <canvas> HTML tag has special rules for handling cross-
 origin image data drawn on the canvas.  If we had written a document
 explaining the same-origin policy before the <canvas> tag existed, we
 wouldn't have been able to anticipate its security needs.

-- 
Ticket URL: <https://svn.tools.ietf.org/wg/hybi/trac/ticket/3#comment:3>
hybi <http://tools.ietf.org/hybi/>
The Hypertext-Bidirectional (HyBi) working group will seek
standardization of one approach to maintain bidirectional
communications between the HTTP client, server and intermediate
entities, which will provide more efficiency compared to the current
use of hanging requests.