4 ms·
For the same-origin problem, the web server could return an Origin header which defines the origin. So the server on example.org could serve https://example.org
by twic 7y ago
For the same-origin problem, the web server could return an Origin header which defines the origin. So the server on example.org could serve https://example.org/~username https://example.org/~username for anything in that account. The defined origin would have to be under the scheme, domain, and port served by the server, of course.
- dwb 7y agoThis is not true; a URL with anything past the port is not a valid "origin" https://tools.ietf.org/html/rfc6454#section-7 https://tools.ietf.org/html/rfc6454#section-7
- joosters 7y agoI think their point was that the concept could be expanded as per their suggestion, as a simple way to fix the security issues. Having the server send a 'this is my site base' header would be helpful even without having path support. At the moment, browsers need to magically know about all multi-level domains, like example.co.uk, so that they don't lump together all *.co.uk domains as the same site.
- twic 7y agoYes, this was my meaning - apologies if i wasn't clear.
- couchand 7y agoThis is brilliant and simple and backwards-compatible. Well done. If I knew anything about the standards process I would write an RFC for it today.