On Tue, Jun 9, 2009 at 9:19 AM, Tyler Close<[email protected]> wrote: > On Tue, Jun 9, 2009 at 12:22 AM, Adam Barth<[email protected]> wrote: >> Please send "Origin: null" in these cases. The problem with omitting >> the origin header is that the server can't tell if the request comes >> from a legacy client or if the header was removed in transit. > > For the GuestXMLHttpRequest scenario, why should the server > distinguish between these two cases?
In one case, the request is coming from the non-guest part of the page in a legacy browser. In the other case, the request is coming from the guest part of the page in a supporting browser. Isn't the whole point of this feature to be able to distinguish guest and non-guest? Adam
