Section 1.3.3 states:<br><br><pre class="newpage">   The security issue of a browser sending a SIP packet to a device that<br>   does not meet the same origin policy is discussed in the section XXX,<br>   but the brief preview of the solution is that the SIP messages can<br>

   use CORS REF much like a HTTP does.<br><br><br></pre>Can you elaborate?  Unlike the media authorization discussion (where a STUN exchange is used to authorize media exchange), it isn&#39;t clear to me how authorization works here.<br>

<br><div class="gmail_quote">On Thu, Mar 10, 2011 at 12:20 PM, Cullen Jennings <span dir="ltr">&lt;<a href="mailto:fluffy@cisco.com">fluffy@cisco.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">

<br>
I wrote up the start of a draft on requirements and a sketch of an API proposal. It is at<br>
<br>
<a href="http://tools.ietf.org/html/draft-jennings-rtcweb-api-00" target="_blank">http://tools.ietf.org/html/draft-jennings-rtcweb-api-00</a><br>
<br>
I view this as very early but starts to list some of the issues and an evolving sketch of how the API might look.<br>
<br>
Cullen<br>
<br>
_______________________________________________<br>
RTC-Web mailing list<br>
<a href="mailto:RTC-Web@alvestrand.no">RTC-Web@alvestrand.no</a><br>
<a href="http://www.alvestrand.no/mailman/listinfo/rtc-web" target="_blank">http://www.alvestrand.no/mailman/listinfo/rtc-web</a><br>
</blockquote></div><br>