Subject: HTTP cross-domain scripting access control W3C document

From: Lisa Dusseault <[email-masked]>
Date: Wed, 19 Nov 2008 14:36:56 -0600

FYI:

http://www.w3.org/TR/access-control/

"This document defines a mechanism to enable client-side cross-site  
requests. Specifications that want to enable cross-site requests in an  
API they define can use the algorithms defined by this specification.  
If such an API is used on http://example.org resources, a resource on http://hello-world.example 
  can opt in using the mechanism described by this specification  
(e.g., specifying Access-Control-Allow-Origin: http://example.org as  
response header), which would allow that resource to be fetched cross- 
site from http://example.org."

_______________________________________________
Apps-Discuss mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/apps-discuss

---

From: Mark Nottingham <[email-masked]>
Date: Thu, 20 Nov 2008 18:30:54 -0800

Have they asked for an APPS area review?

Cheers,

On 19/11/2008, at 12:36 PM, Lisa Dusseault wrote:

> requests. Specifications that want to enable cross-site requests in  
> an API they define can use the algorithms defined by this  
> specification. If such an API is used on http://example.org  
> resources, a resource on http://hello-world.example can opt in using  
> the mechanism described by this specification (e.g., specifying  
> Access-Control-Allow-Origin: http://example.org as response header),  
> which would allow that resource to be fetched cross-site from http://example.org 
> ."
>
>
> APPS-REVIEW mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/apps-review

--
Mark Nottingham       [email-masked]