/lists.whatwg.org/pipermail/whatwg-whatwg.org/2008-September/016377.html

https://github.com/whatwg/whatwg.org · HTML · 85 lines · 74 code · 4 blank · 7 comment · 0 complexity · 6dffa88cd08bfbe62fe09a42ec8e3c3b MD5 · raw file 

    

  1. <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
    2. 

  2. <HTML>
    3. 

  3.  <HEAD>
    4. 

  4.    <TITLE> [whatwg] WebSocket websocket-origin
    5. 

  5.    </TITLE>
    6. 

  6.    <LINK REL="Index" HREF="index.html" >
    7. 

  7.    <LINK REL="made" HREF="mailto:whatwg%40lists.whatwg.org?Subject=Re%3A%20%5Bwhatwg%5D%20WebSocket%20websocket-origin&In-Reply-To=%3C48E1B227.5020104%40arc.net.au%3E">
    8. 

  8.    <META NAME="robots" CONTENT="index,nofollow">
    9. 

  9.    <META http-equiv="Content-Type" content="text/html; charset=us-ascii">
    10. 

  10.    <LINK REL="Previous"  HREF="016358.html">
    11. 

  11.    <LINK REL="Next"  HREF="016366.html">
    12. 

  12.  </HEAD>
    13. 

  13.  <BODY BGCOLOR="#ffffff">
    14. 

  14.    <H1>[whatwg] WebSocket websocket-origin</H1>
    15. 

  15. <!--htdig_noindex-->
    16. 

  16.     <B>Shannon</B> 
    17. 

  17.     <A HREF="mailto:whatwg%40lists.whatwg.org?Subject=Re%3A%20%5Bwhatwg%5D%20WebSocket%20websocket-origin&In-Reply-To=%3C48E1B227.5020104%40arc.net.au%3E"
    18. 

  18.        TITLE="[whatwg] WebSocket websocket-origin">shannon at arc.net.au
    19. 

  19.        </A><BR>
    20. 

  20.     <I>Mon Sep 29 21:59:19 PDT 2008</I>
    21. 

  21.     <P><UL>
    22. 

  22.         <LI>Previous message: <A HREF="016358.html">[whatwg] WebSocket websocket-origin
    23. 

  23. </A></li>
    24. 

  24.         <LI>Next message: <A HREF="016366.html">[whatwg] Canvas performance issue: setting colors
    25. 

  25. </A></li>
    26. 

  26.          <LI> <B>Messages sorted by:</B> 
    27. 

  27.               <a href="date.html#16377">[ date ]</a>
    28. 

  28.               <a href="thread.html#16377">[ thread ]</a>
    29. 

  29.               <a href="subject.html#16377">[ subject ]</a>
    30. 

  30.               <a href="author.html#16377">[ author ]</a>
    31. 

  31.          </LI>
    32. 

  32.        </UL>
    33. 

  33.     <HR>  
    34. 

  34. <!--/htdig_noindex-->
    35. 

  35. <!--beginarticle-->
    36. 

  36. <PRE>Anne van Kesteren wrote:
    37. 

  37. &gt;<i> What is the reason for doing literal comparison on the 
    38. 

  38. </I>&gt;<i> websocket-origin and websocket-location HTTP headers? Access Control 
    39. 

  39. </I>&gt;<i> for Cross-Site Requests is currently following this design for 
    40. 

  40. </I>&gt;<i> access-control-allow-origin but sicking is complaining about so maybe 
    41. 

  41. </I>&gt;<i> it should be URL-without-&lt;path&gt; comparison instead. (E.g., then 
    42. 

  42. </I>&gt;<i> <A HREF="http://example.org">http://example.org</A> and <A HREF="http://example.org:80">http://example.org:80</A> would be equivalent.)
    43. 

  43. </I>&gt;<i>
    44. 

  44. </I>&gt;<i>
    45. 

  45. </I>I think the temptation to standardise features like access control 
    46. 

  46. defeats the point of websockets. Since things like access control and 
    47. 

  47. sessions can be readily implemented via CGI interfaces it seems implied 
    48. 

  48. that the whole point of websockets is to provide &quot;lightweight&quot; services. 
    49. 

  49. If the service actually needs something like this then the author can 
    50. 

  50. perform the check post-handshake using any method they feel like. I 
    51. 

  51. don't really feel strongly one way or the other about this particular 
    52. 

  52. header but I'm concerned about the slippery-slope of complicating the 
    53. 

  53. HTTP handshake to the point where you might as well be using CGI. Maybe 
    54. 

  54. the standard should simply recommend sending the header but make no 
    55. 

  55. requirement about how it is parsed. That way the service itself can 
    56. 

  56. decide whether the check is even necessary and if so whether it should 
    57. 

  57. be strict or loose or regex-based without the client automatically 
    58. 

  58. hanging up the connection.
    59. 

  59. 

  60. Shannon
    61. 

  61. 

  62. </PRE>
    63. 

  63. 

  64. <!--endarticle-->
    65. 

  65. <!--htdig_noindex-->
    66. 

  66.     <HR>
    67. 

  67.     <P><UL>
    68. 

  68.         <!--threads-->
    69. 

  69. 	<LI>Previous message: <A HREF="016358.html">[whatwg] WebSocket websocket-origin
    70. 

  70. </A></li>
    71. 

  71. 	<LI>Next message: <A HREF="016366.html">[whatwg] Canvas performance issue: setting colors
    72. 

  72. </A></li>
    73. 

  73.          <LI> <B>Messages sorted by:</B> 
    74. 

  74.               <a href="date.html#16377">[ date ]</a>
    75. 

  75.               <a href="thread.html#16377">[ thread ]</a>
    76. 

  76.               <a href="subject.html#16377">[ subject ]</a>
    77. 

  77.               <a href="author.html#16377">[ author ]</a>
    78. 

  78.          </LI>
    79. 

  79.        </UL>
    80. 

  80. 

  81. <hr>
    82. 

  82. <a href="http://lists.whatwg.org/listinfo.cgi/whatwg-whatwg.org">More information about the whatwg
    83. 

  83. mailing list</a><br>
    84. 

  84. <!--/htdig_noindex-->
    85. 

  85. </body></html>
    86.