Re: [security-services] Fragment identifiers (again)

["Eve L. Maler" <eve.maler@sun.com>]

At 07:22 PM 2/5/02 -0500, Rich Salz wrote:
>The W3C rules (for what it's worth) require every XML spec to be
>xml:base-aware, even if they say "no special semantics."

Not so.  From http://www.w3.org/TR/xmlbase/:

"The deployment of XML Base is through normative reference by new 
specifications, for example XLink and the XML Infoset. Applications and 
specifications built upon these new technologies will natively support XML 
Base. The behavior of xml:base attributes in applications based on 
specifications that do not have direct or indirect normative reference to 
XML Base is undefined."

At some future point, there might be a grand XML unification in which XML 
Base is built in to parser behavior.  But even then, you need to know the 
application's concept of which of its fields are URIs in order to fully 
apply XML Base.

>I believe the intent is less that someone may define xml:base, but
>rather that (as in xml dsig) you define an entity, &dsig, for the base,
>so things like &disg;#x509data make sense.
>
>SOAP, of course, does not allow DTD's, so no entitities, so there's no
>gain.  And using xml:base there might be confusing, since some SOAP
>toolkits might want to use it themselves.  (None that I know of, but
>still...)

XML Base merely provides an in-band, element-granularity way to set a 
base.  There are other ways (e.g., by fiat in the application's spec, which 
I suggested before).  It's probably too late/complicated for us to get into 
the XML Base business this time around, but perhaps a later version...

         Eve
--
Eve Maler                                    +1 781 442 3190
Sun Microsystems XML Technology Center   eve.maler @ sun.com