ISSUE-73: Opting into methods/headers

Opting into methods/headers

State:: CLOSED
Product:: CORS
Raised by:: Anne van Kesteren
Opened on:: 2008-06-06
Description:: The current Access Control model allows all methods to be used and all headers (apart from a blacklist and some headers require a preflight request in case of GET).

There is a proposal to only allow methods and headers the server has opted into:

[AC] Helping server admins not making mistakes
<http://lists.w3.org/Archives/Public/public-appformats/2008May/0034.html>

This would make the server more secure by default when opting into Access Control.

The drawback is again that it makes the model more complicated and more prone to bugs.
Related Actions Items:: No related actions
Related emails:: No related emails

Moved to Issue #14 in the Web Application WG's Issues database:
<http://www.w3.org/2008/webapps/track/issues/14>

23 Jun 2008, 19:46:49