attachment
<html><head><meta http-equiv="content-type" content="text/html; charset=us-ascii"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">All,<div><br></div><div>Continuing this thread concerning resource URIs and the Same Origin policy that is used in web browsers for this sort of thing:</div><div><br></div><div>1. Web Browsers support a HTTP extension called Cross-Origin Resource Sharing (CORS), which is documented here:</div><div><br></div><div> https://fetch.spec.whatwg.org/#http-extensions</div><div><br></div><div> The kicker is that this extension is used to allow PUT and POST requests - GET, HEAD, and OPTIONS requests are *not* limited in any way. So it doesn't look like CORS is a solution for IPP resources.</div><div><br></div><div>2. Sharing OAuth bearer tokens across domain names probably won't work in the general case, either, because the resource URI passed in the authorization request will be different...</div><div><br></div><div>Given these discoveries, I think we just need to reword the conformance requirements to be explicitly clear, something like:</div><div><br></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div>4.2.6 Printer ICC Profiles, Icons, and Other URIs</div><div><br></div><div>URIs reported by the Proxy to the Infrastructure Printer in an Update-Output-Device-Attributes (section 5.10) request MUST be Public Internet Accessible<font color="#ff2600">, Network Accessible without credentials, or hosted by the Infrastructure Printer (with the same credentials) </font>so that both the Infrastructure Printer and Client can access them. The following Printer attributes, if supported by the Proxy, MUST be reported with Public Internet Accessible<font color="#ff2600">, Network Accessible, or Infrastructure Printer hosted </font>URIs: "printer-icc-profiles" ("profile-uri" member attribute), "printer-icons", "printer-more-info-manufacturer", and "printer-strings-uri".</div></blockquote><div><br></div><div>In short: public Internet, private Intranet, or server-hosted using the same credentials.</div><div><br></div><div>Thoughts?</div><div><br></div><div>________________________</div><div><div>Michael Sweet<br>
</div>
<br></div></body></html>