RE: action-334, issue-112, a summary on sub-domains for exceptions

Hi Shane,

 

There is no attempt here to over-architect, the problem is coming up with a
mechanism that doesn't involve abandoning the same origin rule. The
same-party array method also does that but it is limited to an explicit
public list which can be audited, so probably OK. We could ask for
user-agents to insist that both domains referenced each other in their
same-party arrays as a further safeguard if necessary.

 

Mike