Subject: [hybi] #3: Origin-based security model

From: "hybi issue tracker" <[email-masked]>
Date: Tue, 18 May 2010 11:52:47 -0000

#3: Origin-based security model
-------------------------------------------+--------------------------------
 Reporter:  salvatore.loreto@…             |       Owner:     
     Type:  task                           |      Status:  new
 Priority:  minor                          |   Milestone:     
Component:  websocket-requirements         |     Version:     
 Severity:  -                              |    Keywords:     
-------------------------------------------+--------------------------------
 During the last IETF meeting in Anaheim it was pointed out
 that there is no specification (IETF RFC or W3C spec) that clearly
 describe the "Origin-based security model"

 I have opened this issue, only to keep track of it!
 It does not up to HyBi wg specify it, but it would be good have the model
 clearly specified!

-- 
Ticket URL: <https://svn.tools.ietf.org/wg/hybi/trac/ticket/3>
hybi <http://tools.ietf.org/hybi/>
The Hypertext-Bidirectional (HyBi) working group will seek
standardization of one approach to maintain bidirectional
communications between the HTTP client, server and intermediate
entities, which will provide more efficiency compared to the current
use of hanging requests.

---

From: "hybi issue tracker" <[email-masked]>
Date: Tue, 18 May 2010 16:32:02 -0000

Comment(by ietf@…):

 There actually is such a document:
 http://tools.ietf.org/html/draft-abarth-origin

-- 
Ticket URL: <https://svn.tools.ietf.org/wg/hybi/trac/ticket/3#comment:1>

---

From: "hybi issue tracker" <[email-masked]>
Date: Tue, 18 May 2010 17:00:20 -0000

Comment(by julian.reschke@…):

 Well, that document defines several things related to a policy (the term,
 serializations, comparison, a header), but not really what the policy
 *is*. For instance, how does the text define a policy for XHR or
 Websockets?

-- 
Ticket URL: <https://svn.tools.ietf.org/wg/hybi/trac/ticket/3#comment:2>

---

From: "hybi issue tracker" <[email-masked]>
Date: Tue, 18 May 2010 17:21:06 -0000

Comment(by ietf@…):

 I think you have the dependencies backwards.  XMLHttpRequest and
 WebSockets define a policy by referencing the algorithms in that document.
 The same-origin policy varies by API so it's not possible to write a once-
 and-for-all document that explains it.

 As an example, the <canvas> HTML tag has special rules for handling cross-
 origin image data drawn on the canvas.  If we had written a document
 explaining the same-origin policy before the <canvas> tag existed, we
 wouldn't have been able to anticipate its security needs.

-- 
Ticket URL: <https://svn.tools.ietf.org/wg/hybi/trac/ticket/3#comment:3>

---

From: "hybi issue tracker" <[email-masked]>
Date: Tue, 18 May 2010 17:54:22 -0000

I think we actually agree. That draft defines certain constructs than can
 be used to define a "same-origin" policy. But It's not defining it itself.

-- 
Ticket URL: <https://svn.tools.ietf.org/wg/hybi/trac/ticket/3#comment:4>