Re: [websec] Comments on draft-abarth-principles-of-origin-00, was: Reviews of draft-ietf-websec-origin and principles-of-origin - until end of May

[Adam Barth <[e-mail]>]

On Fri, May 13, 2011 at 1:47 AM, Julian Reschke <[e-mail]> wrote:
> Terminology: replace "URL" by "URI" throughout.

Done.

> Replace "MIME type" by "media type" throughout.

Done.

> Add proper references.

Which references would you like to see added?

>   A: Although the DNS has hierarchical delegation, the trust
>   relationships between host names vary by deployment.  For example, at
>   many educational institutions, students can host content at
>   https://example.edu/~student/, but that does not mean a document
>   authored by a student should be part of the same origin (i.e.,
>   represent the same principal) as a web application for managing
>   grades hosted at https://grades.example.edu/.
>
> Comment: Maybe point out that under this arrangement, the URIs for different
> students *will* be in the same origin?

Done.

> 4.  Authority
>
> It's a bit unfortunate that "authority" is used by RFC 3986 (URI) for
> something slightly different. If we don't want to change the term (which I
> assume) then it might be a good idea to clarify that this is not the same
> thing as the "authority" component of a URI as defined in
> <http://greenbytes.de/tech/webdav/rfc3986.html#rfc.section.3.2>.

Done.

Thanks!
Adam