4 ms·
This is not true; a URL with anything past the port is not a valid "origin" https://tools.ietf.org/html/rfc6454#section-7 https://tools.ietf.org/html/rfc6454#s
by dwb 7y ago
This is not true; a URL with anything past the port is not a valid "origin"
https://tools.ietf.org/html/rfc6454#section-7 https://tools.ietf.org/html/rfc6454#section-7
- joosters 7y agoI think their point was that the concept could be expanded as per their suggestion, as a simple way to fix the security issues. Having the server send a 'this is my site base' header would be helpful even without having path support. At the moment, browsers need to magically know about all multi-level domains, like example.co.uk, so that they don't lump together all *.co.uk domains as the same site.
- twic 7y agoYes, this was my meaning - apologies if i wasn't clear.