[http-state] Closing Ticket 6: host-only cookies

Adam Barth <ietf@adambarth.com> Sat, 13 February 2010 07:54 UTC

Return-Path: <adam@adambarth.com>
X-Original-To: http-state@core3.amsl.com
Delivered-To: http-state@core3.amsl.com
Received: from localhost (localhost []) by core3.amsl.com (Postfix) with ESMTP id B7C723A770F for <http-state@core3.amsl.com>; Fri, 12 Feb 2010 23:54:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.853
X-Spam-Status: No, score=-1.853 tagged_above=-999 required=5 tests=[AWL=0.124, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622]
Received: from mail.ietf.org ([]) by localhost (core3.amsl.com []) (amavisd-new, port 10024) with ESMTP id Py1iYIBXlxaP for <http-state@core3.amsl.com>; Fri, 12 Feb 2010 23:54:13 -0800 (PST)
Received: from mail-px0-f178.google.com (mail-px0-f178.google.com []) by core3.amsl.com (Postfix) with ESMTP id 0C2A43A7972 for <http-state@ietf.org>; Fri, 12 Feb 2010 23:54:13 -0800 (PST)
Received: by pxi8 with SMTP id 8so2103492pxi.19 for <http-state@ietf.org>; Fri, 12 Feb 2010 23:55:32 -0800 (PST)
MIME-Version: 1.0
Received: by with SMTP id q10mr1698934rvl.88.1266047732088; Fri, 12 Feb 2010 23:55:32 -0800 (PST)
From: Adam Barth <ietf@adambarth.com>
Date: Fri, 12 Feb 2010 23:55:12 -0800
Message-ID: <7789133a1002122355s6f8b6e75oe1ecd1f7234dcc45@mail.gmail.com>
To: http-state <http-state@ietf.org>
Content-Type: text/plain; charset=ISO-8859-1
Subject: [http-state] Closing Ticket 6: host-only cookies
X-BeenThere: http-state@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Discuss HTTP State Management Mechanism <http-state.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/http-state>, <mailto:http-state-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/http-state>
List-Post: <mailto:http-state@ietf.org>
List-Help: <mailto:http-state-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/http-state>, <mailto:http-state-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 13 Feb 2010 07:54:13 -0000

Discussion about Ticket 6 seems to have quieted down.

== Summary of Discussion ==

Daniel Stenberg argued that we'll be stuck with IE's behavior for a
while, so we should spec that implementing host-only is optional.

Maciej Stachowiak suggested that we not assume Microsoft won't
implement host-only without actually hearing it from them.  (Note:
Microsoft neither committed to implementing host-only nor refused to
implement it.)

Dan Winship suggested that we should require user agents implement
host-only cookies but that we should warn servers that some legacy
user agents don't.

Roy T. Fielding argued that the security benefits of host-only trumped
IE not implementing host-only.

Blake Frantz supported Dan Winship.

== Resolution ==

I've changed the spec as suggested by Dan Winship and supported by Roy
T. Fielding and Blake Frantz.  To wit:

1) User agents are required to implement host-only cookies (matching
the behavior of Firefox, Chrome, Safari, and Opera).

2) The spec warns the reader that some legacy user agents (in this
case IE) do not implement host-only cookies.

I've pushed a new version of the draft with these changes:


We can re-open the issue if someone presents material new information.