Re: [http-state] Browser Behaviors on Cookie Domain and Public Suffix

[Zhong Yu <[e-mail]>]

I will not file the errata at this time; the situation at publicsuffix.org
is quite confusing [1] ; we need more time before things settle down.
Implementers depending on rfc6265 and publicsuffix.org need to figure out
what to do on their own.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1139842#c69

Zhong Yu
bayou.io


On Sun, May 24, 2015 at 9:01 PM, Zhong Yu <[e-mail]> wrote:

> Based on the previous observations and reasonings, I'm going to propose an
> Errata for rfc6265. Since the subject is messy and controversial, I'll wait
> for some time though. If nobody objects, I'll submit the Errata on Thursday.
>
> I think an errata is needed here because an implementer reading the RFC
> and publicsuffix.org may have missed the nuances, and accidentally
> allowed super cookies.
>
> Proposed Errata: (technical)
>
> Section 5.3 says:
>
>    If the user agent is configured to reject "public suffixes" and the
> domain-attribute is a public suffix:
>
>            If the domain-attribute is identical to the canonicalized
> request-host:
>
>               Let the domain-attribute be the empty string.
>
>            Otherwise:
>
>               Ignore the cookie entirely and abort these steps.
>
>
> It should say:
>
>    If the user agent is configured to reject "public suffixes" and the
> domain-attribute is a TLD, or a public suffix, or any parent domain of a
> public suffix:
>
>               Ignore the cookie entirely and abort these steps.
>
>
> Notes:
>
> 1. "TLD" is explicitly mentioned, because a TLD may not be a public suffix.
>
> 2. "parent of public suffix" is explicitly mentioned, because it may not
> be a public suffix.
>
> 3. The clause to set domain-attribute="" is removed for simplicity and
> interoperability; only Firefox implements it; and it doesn't seem very
> useful.
>
> --
>
> Zhong Yu
> bayou.io
>