CVS log for 2006/waf/access-control/Overview.src.html

Request diff between arbitrary revisions

rename Access-Control-Origin to Origin

style sheet tweaks

add security warnings for Access-Control-Policy-Path

rename method check to access preflight

introduce the header blacklist/whitelist in a more clear way; Cross-Site versus Cross-site

handle entity body

allow custom request headers

clarify what 'host name' should match

mention DNS rebinding and protection against it

fix typo; use .example

WD

typo

ban userinfo in redirects

omit default port from access control origin

make some small editorial changes

make stuff a bit more clear; solve an issue

new-style ABNF begone for now; lets be practical

make security section more clear; address concern from tlr regarding redirects

referrer begone

minor editorial cleanup

the great renaming; thanks to Hixie

initial attempt to remove 'deny' and method stuff

behold, ABNF

make several editorial improvements

oops; revert search & replace mistake in requirements

fix some small bugs; add a few notes

add two examples to the non-GET processing model

typos

introduce the method check policy for sets of URIs

authorization request is now method check request and authorization request cache is now method check result cache; apologies for the inconvenience

integrate requirements proposals

revert some 'editorial' fixes; fix mistake in access control check algorithm

use hosting specification throughout

move question to security section where it belongs

remove confusing informative text and drop the method pseudo-attribute

new introduction and various other editorial changes

minor editorial change: "specified in the <b>expiry time</b>
field" (added missing "the")

Method-Check-Max-Age it is

elaborate on examples; fix typo - thanks mike\!

s/Method-Check-Expires/Method-Check-Maxage/

make editorial changes as suggested by art and jonas

Per discussion with Anne, checking in minor editorial changes made
for clarity. The majority of the changes amount to adding commas
and parenthesis, and almost no wordsmithing changes of any kind.

make methods space-separated; add question about path stuff

add a FAQ entry on JSONRequest; fix sentences in abstract and introduction; thanks tlr

make it more clear that some requirements apply to both the request and response entity body

update introduction; mention specific attack vectors to take into account

mention race conditions

encourage authors to check Referer-Root

add requirements, use cases, and a design decision FAQ to the specification

improve the English

Let the authorization request use OPTIONS as server fixes are (being) deployed

fix markup error; add case-insensitive domain sample

make it clear that referrer root URI is ToASCII'd; add examples to match algorithm

make security requirements more clear

require method= to not be empty

put the generic bits at the end instead

revise the introduction, type

make heading names consistent; give security and conformance their own section

publish Monday

WD ready

several editorial changes

more sampling

remove error flag; reason flag -> status flag

make authorization cache stuff a bit more clear and specific

fix space-separated list parsing; remove a confusing encouragement

temp method list needs to get all methods listed; try to clarify algorithms a bit more

make things more consistent

address another small issue

add wording to handle the method pseudo-attribute

better introduction; fix a bunch of issues with the processing section based on Hixie's feedback (not all of it though)

fix example; clarify type of header; define auth request; mention that auth requests should prevent their response from being cached

more text

change structure

A major revision that takes the F2F input into account, though it still needs work.
Access-Control and <?access-control?> now have a 'method' property. Cross-site requests are properly defined. More algorithms. More shared algorithms. More complexity...

test

make several editorial changes

fix markup

add some very simple examples

update security section

define semantics of new HTTP headers more clearly

let port default to prevent security problems; TODO: elaborate about this in the security section

s/If-Method-Allowed/Method-Check/ because If-Method-Allowed is not consistent with other If- headers

create EBNF for Referer-Root and If-Method-Allowed HTTP header for people who care; fix some grammar

update id= referrer root URI; require If-Method-Allowed header

s/WD/ED/; s/requesting URI/referrer root URI/; PI parsing more clear and hopefully without errors; better requirements on requesting root URI

W3C WD

address some comments regarding the access item syntax

mention some other potential issues

add Referer-Root + editorial

editorial changes

make security section clearer

expand a bit on the introduction

access requests are now to be defined by other specs, such as XHR; rename header to Access-Control

drop trailing . from domain; bar.com matches foo.bar.com now; several editorial changes

introduce new terminology and better section organization

explain some things better

make some editorial changes requested by MW

make it an editor's draft again

make it a W3C WD

TBL likes requesting URI better

make some editorial changes to the security section as suggested by Art

fix references and conformance section

integrate new Abstract and Introduction from Art

text/xsl is not an XML MIME type; clarify XML parsing requirements; add <?access control deny=...?>

make several improvements to the match algorithm

fix match list and exclude list cross references

add Mohamed to the acknowledgements

define XML MIME type, fix several typos and clearly mark XML parsing as issue

update acknowledgements and mention same origin policy

try to explain 'deny' better

remove 'in error' stuff

integrate several of Hixie's suggestions: make the resource request algorithm a more explicit algorithm and try fixing request URL and 'match'

fix typo

more editorial

fix some editorial issues

make major changes to how user agents need to process the whole thing; also add "deny" besides "allow" for HTTP headers

use terminate rather than abort and fix some editorial stuff

make scheme optional, make port optional; port no longer defaults to the scheme in use; this allows example.org as access item

add a previous version

add some samples to <?access-control?> and note an issue that needs solving

more fixes

explain the just added sample

fix some terminology and add two examples for Content-Access-Control header so people can more easily review how it's supposed to work

change origin item to origin label and item item to item label

markup fix

The previous commit should have stated that * is now only allowed at the start of a subdomain and not in the middle and matches any number of labels