Access-control, P.I.

Charles McCathieNevile
Chief Standards Officer - Opera Software

chaals@opera.com

A history

• Voice application data
• Cross-domain access
• Simple mechanism
• Implementation

How it works

<?access-control allow="example.com"?>

• allow/deny
• IP addresses
• domain names
• Use of * as a wildcard

Processing rules

• IP beats domain name
• deny beats allow
• specific beats wildcard
• (very roughly)

Other use cases

• XML HTTP Request
  - e.g. TimBL's Tabulator
• Cross Document Access
• links in SVG, CSS
• more...?

Development...

• WHAT-WG
  - equivalent HTTP Header
• WAF working group
• W3C Team review

May 17, W3C Working Draft
http://dristachi.site/TR/access-control

Outstanding !
^ issues

• Processing instruction - blergh
• Different ports, schemes?
• More granular - path?
• Request and parse "blind"

Future...

• More implementation
• Rechartered WAF deliverable
• Used in other specs?

Useful, not The Solution

Thank you

There are no foolish questions
only fools who do not question

chaals@opera.com