Subject: [secdir] Soliciting reviews for Cross-Origin Resource Sharing

From: Mark Nottingham <[email-masked]>
Date: Mon, 6 Apr 2009 19:37:57 +1000

[ with my IETF/W3C Liaison hat on ]

Members of the WebApps WG in the W3C have brought Cross-Origin  
Resource Sharing (CORS) to my attention, and asked for review/input  
from IETF folks.

http://www.w3.org/TR/2009/WD-cors-20090317/

> This document defines a mechanism to enable client-side cross-origin  
> requests. Specifications that want to enable cross-origin requests  
> in an API they define can use the algorithms defined by this  
> specification. If such an API is used on http://example.org  
> resources, a resource on http://hello-world.examplecan opt in using  
> the mechanism described by this specification (e.g., specifying  
> Access-Control-Allow-Origin: http://example.org as response header),  
> which would allow that resource to be fetched cross-origin from http://example.org 
> .

The document's status section contains information about how to  
provide feedback to them.

I know that generally the security directorate review process is for  
review of IETF documents, but this document does have the potential  
for impacting IETF technologies, and is directly security-related. If  
the directorate is unable to provide a review, please forward this to  
the appropriate folks in the IETF security community who may be  
interested in providing individual reviews and feedback to the WG.

Cheers,

--
Mark Nottingham     http://www.mnot.net/