Entire Sprint Team: Read up on Content-origin policies

[flyingzumwalt]

Content-origin policies are a fundamental aspect of browser functionality. Mozilla is grappling with the challenge of making Content-origin policies work with content-addressed content.

• Read the history on this, including the history of experiments and mess-ups
• Read issue Sort out an Address Scheme that fits with Browser Security Model #3 and the issues it links to

The Single-origin Policy is a central pillar of the browser security model. Its based on the assumption of http, a centralized protocol, meaning that content's identity (and therefore security) is bound to the location its being retrieved from.

Related:

• CSRF
• CORS
• JSON-P
• web sockets
• Cross Document messaging