Subject: [websec] [Technical Errata Reported] RFC6454 (3249)

From: RFC Errata System <[email-masked]>
Date: Fri, 8 Jun 2012 05:59:55 -0700 (PDT)

The following errata report has been submitted for RFC6454,
"The Web Origin Concept".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=6454&eid=3249

--------------------------------------
Type: Technical
Reported by: Anne van Kesteren <[email-masked]>

Section: 7.1. Syntax

Original Text
-------------
origin              = "Origin:" OWS origin-list-or-null OWS
origin-list-or-null = %x6E %x75 %x6C %x6C / origin-list
origin-list         = serialized-origin *( SP serialized-origin )

Corrected Text
--------------
origin              = "Origin:" OWS origin-or-null OWS
origin-or-null      = %x6E %x75 %x6C %x6C / serialized-origin

Notes
-----
Rationale: List of origins was added for CORS http://www.w3.org/TR/cors/ but CORS does not require it and we should leave this as a choice.

This syntax restriction also has limited impact on 7.2. and 7.3.

See also: http://lists.w3.org/Archives/Public/www-archive/2012Jun/thread.html#msg1

Instructions:
-------------
This errata is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC6454 (draft-ietf-websec-origin-06)
--------------------------------------
Title               : The Web Origin Concept
Publication Date    : December 2011
Author(s)           : A. Barth
Category            : PROPOSED STANDARD
Source              : Web Security
Area                : Applications
Stream              : IETF
Verifying Party     : IESG