4 ms·
I actually do not understand, why this hasn't been addressed over all those years. As far as the evaluation of origin is concerned, we may easily implement some
by masswerk 7y ago
I actually do not understand, why this hasn't been addressed over all those years. As far as the evaluation of origin is concerned, we may easily implement something like:
If the path field of a URL contains a tilde directory, do the following: 1) split the path after the tilde directory, 2) add the first part to the host field, 3) use the second part as the new path field.
If there are any concerns regarding compatibility, make it opt-in via a HTTP header field.
- tgv 7y agoThe tilde is just a convention. There are also sites that map it to /home/<user> or something. Perhaps extending the Accept-Origin headers could work. But the basic message is: don't expect any protection from cross-directory script attacks, so use domain names for anything serious.