This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit

AppSecEU08 HTML5

Jump to: navigation, search

AppSecEU08 > Agenda and Presentations > HTML5 Security

Slides and Contact

Slides: Would you like fries with that?

Contact: Thomas Roessler, W3C Security Activity Lead, [email protected]

HTML5 resources

Specific parts of the specification that were mentioned during the talk:

Also of interest, but added even more recently:

Cross-domain XMLHttpRequest

Note that the "access-control" specification provides a mechanism for authorizing exceptions to the same-origin policy. How that authorization (and the data retrieved) is used isn't actually specified. For XMLHttpRequest, the governing specification is XMLHttpRequest Level 2. Don't read one without the other.

Also relevant:

Relevant work is currently occuring in the Web API and Web Application Formats Working Groups at W3C. A proposed restructuring of that work is currently being negotiated.

About W3C