Subject: [hybi] Access-Control-Allow-Origin ?

From: Greg Wilkins <[email-masked]>
Date: Tue, 30 Aug 2011 10:10:06 +1000

Now that we have moved to use the normal Origin header, I'm wondering
if we should not also use the standard Access-Control-Allow-Origin
response.

With XHR and CORs the flow goes:

 1) Browser sends preflight request with Origin set.
 2) Server checks origin sends response with Access-Control-Allow-Origin
 3) The client is then the policy enforcement point as it configures
the browser sandbox accordingly

With WS, the flow is different:
 1) Browser sends handshake request with Origin
 2) Server checks the origin and is the policy enforcement point. It
either accepts or reject the connection.

The issue with this is that it means that the server has to have
policy enforcement logic within the protocol layer.  Typically (google
CORS filter) on servers, CORs has been handled by adding a filter in
front of the normal resource handling that implements the origin
checking and sets the allow header accordingly.  The server does not
actually enforce the policy.

It would be great if we enabled use of these same server side CORs
filters with WS.   To do so, we only need to require that the
handshake 101 response contains the Access-Control-Allow-Origin header
for any handshakes that contain an origin header and that the server
thinks is cross origin.    The client then becomes the policy
enforcement point and can close the connection if it does not have
this header, but may accept it if it thinks the connection is not
cross origin.   Note that the server is still able to enforce the
policy if it wishes and not accept the connection.

So this is really an extra requirement on browser clients,  if they
send a cross origin connection, they MUST set the origin header in the
handshake and they MUST check for a Access-Control-Allow-Origin header
in the 101.   For non cross origin connections, they can either not
send the Origin, or can not check for the allow header.

Servers SHOULD send an Access-Control-Allow-Origin header in the 101
if there is an Origin header in the handshake and the origin is
Acceptable to them.

thoughts?

---

From: "Thomson, Martin" <[email-masked]>
Date: Tue, 30 Aug 2011 15:05:40 +0800

On 2011-08-30 at 10:10:06, Greg Wilkins wrote:
> thinks is cross origin.    

Sounds like a good idea.  Consistent with the philosophy of "HTTP before Upgrade".

--Martin