Re: [websec] Principles of the Same-Origin Policy

[Peter Saint-Andre <[e-mail]>]

On 2/24/11 2:39 PM, Adam Barth wrote:
> On Thu, Feb 24, 2011 at 1:22 PM, Peter Saint-Andre <[e-mail]> wrote:
>> On 2/21/11 3:10 PM, Adam Barth wrote:
>>> Pursuant to the charter, I've posted an informational draft that
>>> "describes the same-origin security model overall:"
>>>
>>> http://www.ietf.org/id/draft-abarth-principles-of-origin-00.txt
>>>
>>> I don't expect this document to be very controversial.  I'm sure folks
>>> will nitpick me over renaming URL to URI and MIME types to media
>>> types, however.  :)
>>
>> Adam, what do you see as the relationship or division of work between
>> draft-ietf-websec-origin and draft-abarth-principles-of-origin?
> 
> Just what it says in the charter:
> 
> [[
>   The
>   working group may split draft-abarth-origin into separate informative
>   and standards track specifications, the former describing same-origin
>   security model, and the latter specifying the nuts-and-bolts of working
>   with origins (computing them from URLs, comparing them to each other,
>   etc).
> ]]
> 
> Principles-of-origin is an informative document that explains the
> underlying concepts of the security model.  Draft-ietf-websec-origin
> is a normative document that explains the low-level details of how to
> construct, compare, and serialize origins.  I don't feel strongly
> about whether they're separate documents or the same document.  I just
> thought it would be better to gather feedback in an individual draft
> first in either case.

Thanks for the explanation, that's quite helpful. I'm going to read them
with that distinction in mind...

Peter

-- 
Peter Saint-Andre
https://stpeter.im/