17802 2012-07-18 04:37:52 +0000 appcache: SOP requirement for cache manifest files should be relaxed (at least) by CORS. 2012-07-23 03:55:10 +0000 1 1 1 Unclassified WHATWG HTML unspecified Other other RESOLVED WONTFIX P3 normal Unsorted 1 contributor ian adrianba annevk blizzard ian jonas michaeln mike tobie.langel contributor oldest_to_newest 70072 0 contributor 2012-07-18 04:37:52 +0000 This was was cloned from bug 14705 as part of operation convergence. Originally filed: 2011-11-05 21:49:00 +0000 Original reporter: Tobie Langel <tobie.langel@gmail.com> ================================================================================ #0 Tobie Langel 2011-11-05 21:49:20 +0000 -------------------------------------------------------------------------------- This enables putting the manifest files on a CDN. ================================================================================ #1 Ian 'Hixie' Hickson 2011-11-11 00:22:15 +0000 -------------------------------------------------------------------------------- Status: Rejected Change Description: no spec change Rationale: It would also enable a hostile open wifi access point to permanently hijack facebook.com to point to evil.example.net, which seems, to put it mildly, problematic. ================================================================================ #2 michaeln@google.com 2011-11-11 20:44:58 +0000 -------------------------------------------------------------------------------- Reopening in the hopes of gathering more input about why the SOP for this is a problem and what might be done to resolve it. ================================================================================ #3 Ian 'Hixie' Hickson 2011-12-03 22:23:56 +0000 -------------------------------------------------------------------------------- Reassigning to michaeln as per comment 2. If you gather actionable input, please don't hesitate to reassign this to me so I can study it further. ================================================================================ #4 Tobie Langel 2012-01-24 22:14:21 +0000 -------------------------------------------------------------------------------- This was an attempt at solving use-case #2 here: http://www.w3.org/community/fixing-appcache/2012/01/18/appcache_use_cases/#use_case_2 Allow an application hosted on a cluster of servers to be easily updated An application is hosted on a cluster of servers behind a non-sticky load balancer. It is updated daily. Even though all servers are not updated instantly and two versions of the application co-exist for a while, it is possible to update the application without risking to have an out-of sync version of the application (e.g. manifest file and assets of the latest version combined with a Master Entry of the previous version) or to need to invalidate the cache to avoid such issues. Probably would have been more useful to provide the use case upfront rather that potential solutions. ================================================================================ 71242 1 ian 2012-07-20 04:32:44 +0000 I can't see how to do this safely. I recommend just having all the backend servers have the same publicly-visible host name with load balancing.