Re: Cross site scripting: CORS and a Javascript library accessing Linked Data

[Ian Davis]

Hi Nathan,

On Mon, May 10, 2010 at 10:49 PM, Nathan  wrote:
> Could everybody publishing linked data please note that open data isn't
> currently retrievable via client side JS libraries due to same origin
> policies and the likes.
>
> In order to make it open and accessible by UAs we need to add in CORS [1]
> headers.
>

Just to be slightly pedantic, this is only a problem for applications
running inside web browser sandbox contexts. Standalone apps,
dedicated semweb browsers, iPhone apps, greasemonkey scripts etc don't
suffer this limitation.

That said, we are looking at CORS for support by Talis with the caveat
that it is still not a REC stage and we prefer to implement agreed
standards rather than ones in progress unless we're very confident
they won't change.

Ian

Re: [pedantic-web] Cross site scripting: CORS and a Javascript library accessing Linked Data

[Nathan]

nat lu wrote:

<2cs>

Why is CORS any better than JSONP or any home-grown js that writes a
new 

Re: [pedantic-web] Cross site scripting: CORS and a Javascript library accessing Linked Data

[nat lu]

<2cs>

   Why is CORS any better than JSONP or any home-grown js that writes a
   new 

Cross site scripting: CORS and a Javascript library accessing Linked Data

[Nathan]

All,

Could everybody publishing linked data please note that open data isn't 
currently retrievable via client side JS libraries due to same origin 
policies and the likes.


In order to make it open and accessible by UAs we need to add in CORS 
[1] headers.


Please see the email below from TimBL which includes a request for a 
linked data bubble diagram showing which systems support CORS, and the 
full issue here on www-tag [2]


[1] http://www.w3.org/TR/cors/
[2] http://lists.w3.org/Archives/Public/www-tag/2010May/0009.html

Kinglsey, Ian, members of the Pedantic Web - I've cc'd you in directly 
for rather obvious reasons :)


Richard/Pedants, will this need to be added to the Publishing Linked 
Data guide / recs?


Best,

Nathan

Tim Berners-Lee wrote:
In mid:4be7bf59.9010...@webr3.org 
aka http://lists.w3.org/Archives/Public/www-tag/2010May/0009.html

on 2010-05 -10, at 04:10, Nathan wrote:

All,


[...lots of cool stuff about making JS client talk to sem web backend ...]


Thus far the only thing I can see that comes any where near to addressing is 
the work in progress Cross-Origin Resource Sharing [1] but afaik it's only 
implemented in the newest browsers + the vast majority of resources on the web 
don't have these headers set so again the application wouldn't be able to 
access most data - rendering any apps made very limited and virtually useless - 
which imho is a huge shame since all the peices needed are ready and waiting on 
billions(?) of machines.


Well, machines which serve public data must now serve the two (why two?!) HTTP 
headers for CORS.
Just lean on data sources you know to do this.  And people have to use new 
browsers to get new functionality.

Note if they run an add-on, like Tabulator, then they skip this problem as the 
code is
deemed trusted.  


[snip]


We could do with a version of the linked data bubble diagram with the systems 
which support CORS in green. Anyone?