This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.

Bug 17802 - appcache: SOP requirement for cache manifest files should be relaxed (at least) by CORS.
Summary: appcache: SOP requirement for cache manifest files should be relaxed (at leas...
Status: RESOLVED WONTFIX
Alias: None
Product: WHATWG
Classification: Unclassified
Component: HTML (show other bugs)
Version: unspecified
Hardware: Other other
: P3 normal
Target Milestone: Unsorted
Assignee: Ian 'Hixie' Hickson
QA Contact: contributor
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-07-18 04:37 UTC by contributor
Modified: 2012-07-23 03:55 UTC (History)
8 users (show)

See Also:


Attachments

Description contributor 2012-07-18 04:37:52 UTC
This was was cloned from bug 14705 as part of operation convergence.
Originally filed: 2011-11-05 21:49:00 +0000
Original reporter: Tobie Langel <tobie.langel@gmail.com>

================================================================================
 #0   Tobie Langel                                    2011-11-05 21:49:20 +0000 
--------------------------------------------------------------------------------
This enables putting the manifest files on a CDN.
================================================================================
 #1   Ian 'Hixie' Hickson                             2011-11-11 00:22:15 +0000 
--------------------------------------------------------------------------------
Status: Rejected
Change Description: no spec change
Rationale: It would also enable a hostile open wifi access point to permanently hijack facebook.com to point to evil.example.net, which seems, to put it mildly, problematic.
================================================================================
 #2   michaeln@google.com                             2011-11-11 20:44:58 +0000 
--------------------------------------------------------------------------------
Reopening in the hopes of gathering more input about why the SOP for this is a problem and what might be done to resolve it.
================================================================================
 #3   Ian 'Hixie' Hickson                             2011-12-03 22:23:56 +0000 
--------------------------------------------------------------------------------
Reassigning to michaeln as per comment 2. If you gather actionable input, please don't hesitate to reassign this to me so I can study it further.
================================================================================
 #4   Tobie Langel                                    2012-01-24 22:14:21 +0000 
--------------------------------------------------------------------------------
This was an attempt at solving use-case #2 here: http://www.w3.org/community/fixing-appcache/2012/01/18/appcache_use_cases/#use_case_2

Allow an application hosted on a cluster of servers to be easily updated
An application is hosted on a cluster of servers behind a non-sticky load balancer. It is updated daily. Even though all servers are not updated instantly and two versions of the application co-exist for a while, it is possible to update the application without risking to have an out-of sync version of the application (e.g. manifest file and assets of the latest version combined with a Master Entry of the previous version) or to need to invalidate the cache to avoid such issues.

Probably would have been more useful to provide the use case upfront rather that potential solutions.
================================================================================
Comment 1 Ian 'Hixie' Hickson 2012-07-20 04:32:44 UTC
I can't see how to do this safely. I recommend just having all the backend servers have the same publicly-visible host name with load balancing.