Re: [websec] Principles of the Same-Origin Policy

[Adam Barth <[e-mail]>]

On Thu, Feb 24, 2011 at 1:22 PM, Peter Saint-Andre <[e-mail]> wrote:
> On 2/21/11 3:10 PM, Adam Barth wrote:
>> Pursuant to the charter, I've posted an informational draft that
>> "describes the same-origin security model overall:"
>>
>> http://www.ietf.org/id/draft-abarth-principles-of-origin-00.txt
>>
>> I don't expect this document to be very controversial.  I'm sure folks
>> will nitpick me over renaming URL to URI and MIME types to media
>> types, however.  :)
>
> Adam, what do you see as the relationship or division of work between
> draft-ietf-websec-origin and draft-abarth-principles-of-origin?

Just what it says in the charter:

[[
  The
  working group may split draft-abarth-origin into separate informative
  and standards track specifications, the former describing same-origin
  security model, and the latter specifying the nuts-and-bolts of working
  with origins (computing them from URLs, comparing them to each other,
  etc).
]]

Principles-of-origin is an informative document that explains the
underlying concepts of the security model.  Draft-ietf-websec-origin
is a normative document that explains the low-level details of how to
construct, compare, and serialize origins.  I don't feel strongly
about whether they're separate documents or the same document.  I just
thought it would be better to gather feedback in an individual draft
first in either case.

Adam