Re: [http-state] Comments on draft-ietf-httpstate-cookie-08

["Yngve N. Pettersen (Developer Opera Software ASA)" <[e-mail]>]

On Sat, 29 May 2010 14:50:47 +0200, Bjoern Hoehrmann <[e-mail]>  
wrote:

> * Yngve Nysaeter Pettersen wrote:
>> * Sec 4.1.2.3
>>
>> -   For example, some user agents will reject Domain attributes of "com"
>> or "co.uk".
>>
>> This seems to imply that there are agents that will accept a TLD as a
>> valid domain (except ".local" from 2965, which is a special case). I'd
>> rather have the section say that a domain attribute need to specify at
>> least a second level domain.
>
> As I understand it, there are a number of frameworks that will auto-
> matically use the server name, or failing that its address, as default
> value for the domain attribute. It does not strike me as a good idea to
> prohibit `Domain=localhost` for instance.

The formal hostname for localhost would be "localhost.local", but in any  
case, in such a situation the hostname would also be non-dotted  
("localhost") and it must exactly match the domain attribute (localhost).  
This kind of situation is handled by Opera.

What I am (implicitly) referring to above is a situation where the domain  
attribute is not equal to the hostname, but domain-matches the hostname,  
*and* where the domain attribute is a *single* level (IOW a TLD). Those  
cases should not be allowed, even by a public suffix list.

If somebody creates a server "com" (for example, setting a cookie for it  
will not (in Opera, and probably other browsers) cause the cookie to be  
valid for all the dot-com servers, since the cookie will be set for the  
implied FQDN "com.local".

Come to think of it, is the single label (local intranet server) situation  
covered in the domain sematics?

-- 
Sincerely,
Yngve N. Pettersen

********************************************************************
Senior Developer                     Email: [e-mail]
Opera Software ASA                   http://www.opera.com/
Phone:  [phone]              Fax:    [phone]
********************************************************************