[http-state] Whether to recommend the cookie protocol (was Re: I-D Action:draft-ietf-httpstate-cookie-04.txt)

[Adam Barth <[e-mail]>]

On Tue, Feb 23, 2010 at 9:10 AM, Anne van Kesteren <[e-mail]> wrote:
> On Tue, 23 Feb 2010 17:15:04 +0100, <[e-mail]> wrote:
>> The cookie protocol has many
>> historical infelicities and should be avoided for new applications of
>> HTTP.
>
> What exactly does this mean?

It means that we don't think new applications of HTTP (e.g., SIP)
should use the cookie protocol.  Cookies have caused significant
security problems for the web.  For new applications, it's probably a
good idea to use another state management mechanism.

> There's no suitable replacement for cookies
> available currently so giving this advice seems a bit premature, but maybe I
> misunderstand what it says.

Hopefully we'll create a suitable replacement in phase two.  If not,
necessity is the mother of invention...

On Tue, Feb 23, 2010 at 9:15 AM, Blake Frantz <[e-mail]> wrote:
> Similarly, the top of section '7.1 General Recommendations' states:
>
> "The cookie protocol is NOT RECOMMENDED for new applications".
>
> This statement may require the same clarification as the one noted by Anne.

What clarification do you have in mind?  Keep in mind that we're
writing this document for the long term.  Just because we don't have
an alternative in mind doesn't mean we won't have better options in
the future.

Would you really recommend that new applications of HTTP use cookies?

Adam