Re:Userdir URLs like https://example.org/~username/ are dang...
by twic on Wednesday April 08, 2020 @02:57AM
(#22810630)
For the same-origin problem, the web server could return an Origin header which defines the origin. So the server on example.org could serve https://example.org/~username for anything in that account. The defined origin would have to be under the scheme, domain, and port served by the server, of course.
[ Parent
| on HN ]
Re:Userdir URLs like https://example.org/~username/ are dang...
by dwb on Wednesday April 08, 2020 @06:16AM
(#22811612)
This is not true; a URL with anything past the port is not a valid "origin"
Re:Userdir URLs like https://example.org/~username/ are dang...
by joosters on Wednesday April 08, 2020 @08:03AM
(#22812139)
I think their point was that the concept could be expanded as per their suggestion, as a simple way to fix the security issues.
Having the server send a 'this is my site base' header would be helpful even without having path support. At the moment, browsers need to magically know about all multi-level domains, like example.co.uk, so that they don't lump together all *.co.uk domains as the same site.