[XHR] XMLHttpRequest specification lacks security considerations

2010-01-18 Thread Thomas Roessler
With apologies for the belated Last Call comment -- the XMLHttpRequest specification http://www.w3.org/TR/XMLHttpRequest/ ... doesn't have meaningful security considerations. Section 3 should at the very least spell out: - Somewhat detailed considerations around CONNECT, TRACE, and TRACK (fl

[XHR] same-origin request event rules are underspecified

2010-01-18 Thread Thomas Roessler
Reviewing the XMLHttpRequest specification, the same origin request event rules are underspecified: http://www.w3.org/TR/XMLHttpRequest/#same-origin-request-event-rules > The same-origin request event rules are as follows: > > If the response is an HTTP redirect > > If th

Re: Re-introduction

2010-01-18 Thread Nikunj Mehta
On Jan 18, 2010, at 3:56 AM, Arthur Barstow wrote: Nikunj, On Jan 16, 2010, at 7:07 PM, ext Nikunj Mehta wrote: I would like to move the IndexedDB spec to Last Call at the earliest possible. Please provide feedback that can help us prepare a strong draft for LCWD. Do you want a fixed-lengt

Re: Re-introduction

2010-01-18 Thread Arthur Barstow
Nikunj, On Jan 16, 2010, at 7:07 PM, ext Nikunj Mehta wrote: I would like to move the IndexedDB spec to Last Call at the earliest possible. Please provide feedback that can help us prepare a strong draft for LCWD. Do you want a fixed-length pre-LC comment period (as we did last November wit

RE: IndexedDB and MVCC

2010-01-18 Thread Pablo Castro
Hi Chris, > -Original Message- > From: public-webapps-requ...@w3.org [mailto:public-webapps- > requ...@w3.org] On Behalf Of Chris Anderson > Sent: Friday, January 15, 2010 11:14 AM > To: public-webapps WG > Subject: IndexedDB and MVCC > > Hi, > > I've been reading the new IndexedDB spec