franksalim's comments

The origin header represents the origin of the script initiating the request. The location is the address of the server. These can be different. By acknowledging the origin of the request, the server explicitly grants access to that origin.

This is similar to the origin model for cross-origin XHRs (http://www.w3.org/TR/access-control/#access-control-allow-or...).

WebSockets have been capable of cross-origin communication since day one. (see: http://tools.ietf.org/html/draft-hixie-thewebsocketprotocol-...) "The |WebSocket-Origin| header is used in the Web Socket handshake. It is sent from the server to the client to confirm the origin of the script that opened the connection. This enables user agents to verify that the server is willing to serve the script that opened the connection."

Hi, Many of the comments here are negative, probably due to the overly sensational title ;-) Since this is a project I have been working on, however, I will do my best to clarify and respond candidly.

This is clearly not a breakthrough. Sockets (or socket-like interfaces) are the most obvious way to communicate a bi-directional stream of bytes. This has been true for decades. The problem is that everybody has been trying to reinvent the wheel for AJAX. So yes, this is not new, just something that had been missing from the web for a long time!

We have been very mindful of the security implications. Orbited uses a strict whitelist and will not allow outgoing connections to addresses (hostname:port) that are not listed in the access configuration.

Feel free to ask me any questions.

-Frank Salim