Subject: Re: HTTPbis and the Same Origin Policy

From: =JeffH <[email-masked]>
Date: Mon, 30 Nov 2009 19:56:55 -0800

> The same-origin policy is originally and primarily about scripting...

Yah, in terms of references to "Same Origin Policy" and where the notion 
originated, everything I can (more-or-less easily) find on the web seems to 
ultimately point back to..

    https://developer.mozilla.org/En/Same_origin_policy_for_JavaScript

..and..

    http://www-archive.mozilla.org/projects/security/components/same-origin.html

=JeffH

---

From: =JeffH <[email-masked]>
Date: Mon, 30 Nov 2009 19:52:23 -0800

I also had noticed of late that the "Same Origin Policy" is essentially 
undocumented, and is communicated by oral and in-the-code tradition (as Tyler 
notes) -- so I'm happy to see Tyler bring it up.

I agree with the sentiment that it isn't something that is appropriate to 
document in the main-line httpbis I-Ds, although I nominally believe it 
deserves mention in draft-ietf-httpbis-security-properties (which I & Barry 
Leiba are ostensibly editing (new draft will be out before Anaheim)).

It appears to me that the "Browser Security Handbook" 
<http://code.google.com/p/browsersec/> is an appropriate place at this time to 
coalesce details wrt Same Origin Policies of various APIs, and that in fact is 
what Michal is apparently doing. See..

Standard browser security features / Same-origin policy
http://code.google.com/p/browsersec/wiki/Part2#Standard_browser_security_features

=JeffH