Re: the same origin policy should not be treated as single site policy.

On Sat, 25 Jun 2011 17:24:05 -0700 (PDT), in message <5fd40f19-6cb6-465e-a0d0-8bc668115776@fq4g2000vbb.googlegroups.com> 
jackiszhp wrote:

> For security reason, the same origin policy is good, but at present,
> it is implemented as the single site policy. I think that we can
> extend the de facto "single site policy" to the authentic "same origin
> policy", i.e. to define origin explicitly. More specific, we can
> define an origin be a set of url (which specifies the protocal, host,
> and port).
> 
> More specifically, when you are at http://www.abc.com/something.html,
> you want to access http://www.def.com/otherthing.html. Cross Origin is
> a control at the server side of http://www.def.com, while cross domain
> restriction is at the browser side which does not allow to access the
> 2nd resource. We need a specification at http://www.abc.com to specify
> what other resources should be allowed to access at the browser side.
> However, at present, there is no such specification although we really
> need such a specification.
> 
> In fact, I think that this is easy to specify. In the html head, we
> can specify additional domains should be allowed to access. Browsers
> read these, then the original domain and the additional domains are
> all deemed to be the same origin. Currently, it is the browser block
> us. I am at http://www.abc.com/something.html, then I access
> http://www.def.com/otherthing.html, with ajax (xmlhttprequest), use
> firefox, I can clearly see that the remote server returns everything,
> and everything is good, but the browser does not allow me to access
> the content.
> 
> If my above proposal is accepted and implemented, then the problem is
> sovled, and security is not jeopodized.


Similar to this proposal:   http://www.w3.org/TR/cors/
For Firefox implementation, see:  https://developer.mozilla.org/en/HTTP_access_control


-- 
Kind regards
Ralph