Good to see the draft move to LC.
* Removed dependency on DOM Level 3 Events * Removed dependency on Window Object 1.0 * Clearly marked which HTTP methods are to raise SECURITY_ERR Thanks for the changes. I noticed the draft (http://www.w3.org/TR/2008/WD-XMLHttpRequest-20080415/) has called out the restricted headers. This is great. Perhaps it would be helpful to mention for each header, why they are restricted. It will help developers (and others concerned who are not security savvy) understand the security philosophy and also help to ensure that headers of equivalent function with different names are also submitted for consideration in this blocked list. (I don't have any that comes to mind currently). -- Sunava Dutta Program Manager (AJAX) - Developer Experience Team, Internet Explorer One Microsoft Way, Redmond WA 98052 TEL# (425) 705-1418 FAX# (425) 936-7329
