Hi All,
I'm currently working on implementing cross-site XMLHttpRequest as
detailed in this draft:
http://lists.w3.org/Archives/Public/public-webapi/2006Jun/0012
However I'm a little bit worried about two things regarding non-GET
requests.
First of all I don't like that POST requests can be made unchecked to
any url. I do realize that this seems possible already using plain/text
encoded forms, but this is possibly something that browsers will need to
change.
Second, I'm a little bit worried about the algorithm used to for non-GET
(non-POST in the current draft) in connection with redirects. From my
understanding the following is a valid scenario:
1. Web page on server A makes a DELETE request to server B
2. XHR implementation sends a GET request to server B
3. Server B redirects to server C
4. Server C sends reply that approves the request using appropriate
headers and an "Allow: DELETE" header
5. XHR implementation sends DELETE request to server B
6. Server B deletes file on requested uri.
What worries me is that in step 5 the DELETE request is sent to server B
even though server B has never explicitly allowed that. Granted, since
the redirect chain for the DELETE request is not the same for the
initial GET request as for the DELETE request, the returned result will
not be accessible to the web page, but that hardly matters as the damage
is already done.
The only thing server B has done is to redirect to server C. This could
be done without any knowledge of XHR or the cross-site spec.
I propose we instead specify that the DELETE request should be done to
the final uri of the redirects in the GET request. And if the DELETE
request produces any redirects then those must not be honored.
Do other people have an opinion? In general it feels to me like
redirects and non-GET requests cross site is a rare edge-case and not
something that is particularly important. So we might as well do the
safe thing. I could even see disallowing redirects entirely, even for
the initial GET request.
Best Regards,
Jonas Sicking
