Anne van Kesteren wrote:
So I just read some things again and it seems CORS is already using
comma-separated lists for some header formats. My thinking now is that
we should just do the same for the Origin header. I think that would
make it (per modified (future) ABNF rules from httpbis):
origin = "Origin" ":" origin-value
origin-value = "null" / #serialized-origin
Apparently the OWS issue will be solved by future drafts of httpbis.
The #list rule should be used as a top-level construct, see
"Multiple message-header fields with the same field-name MAY be present
in a message if and only if the entire field-value for that header field
is defined as a comma-separated list [i.e., #(values)]." --
<http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p1-messaging-07.html#rfc.section.4.2>
So you'd need to make it:
origin = "Origin" ":" origin-value
origin-value = #foobar
foobar = "null" / serialized-origin
Of course that means "null" could appear multiple times; if that is a
problem than that header format may not be the right choice.
BR, Julian
PS: note that "null" matches case-insensitively, is that intended?
