14900 2011-11-22 08:46:27 +0000 note about checking "origin" attribute of MessageEvent 2012-07-25 03:02:21 +0000 1 1 1 Unclassified WebAppsWG HISTORICAL - Server-Sent Events (editor: Ian Hickson) unspecified PC Windows NT RESOLVED NEEDSINFO P2 normal --- 1 vic99999 ian ian mike public-webapps public-webapps-bugzilla oldest_to_newest 60338 0 vic99999 2011-11-22 08:46:27 +0000 http://www.html5rocks.com/en/tutorials/eventsource/basics/#toc-security "Authors should check the origin attribute to ensure that messages are only accepted from domains that they expect to receive messages from. Otherwise, bugs in the author's message handling code could be exploited by hostile sites." That warning is especially relevant for window.postMessage() messages and not so much EventSource and WebSocket and this should be marked in the spec. see http://krijnhoetmer.nl/irc-logs/whatwg/20111122#l-381 69802 1 ian 2012-07-10 20:03:16 +0000 Upon further investigation, that paragraph is already deep within the window.postMessage() part of the spec, it's not generically near the MessageEvent object nor anywhere near the EventSource stuff. Not sure how to make this better.