Re: [http-state] cake spec: server-side initiation only?

Mike Wilson <mikewse@hotmail.com> Fri, 03 December 2010 23:47 UTC

Message-ID: <SNT129-DS18EED7DB682AB192036942A4280@phx.gbl>
From: Mike Wilson <mikewse@hotmail.com>
To: 'Adam Barth' <ietf@adambarth.com>
Date: Sat, 04 Dec 2010 00:48:28 +0100
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Thread-Index: AcuTPGV5h4CpTxRTSr6S8TCH9kCN7QABiDjA
In-Reply-To: <AANLkTimDRJkwXoXt-2Lm6qNjEVcRN5bqdN01_G2+8Df_@mail.gmail.com>
Cc: http-state@ietf.org
Subject: Re: [http-state] cake spec: server-side initiation only?
Precedence: list

Adam Barth wrote:
> On Fri, Dec 3, 2010 at 12:01 PM, Mike Wilson 
> <mikewse@hotmail.com> wrote:
> > Reading http://www.ietf.org/id/draft-abarth-cake-00.txt,
> > I wonder if client-side nonce generation (as initially
> > proposed on the mailing list) was dropped altogether or
> > just hasn't been speced yet?
>
> [...] 
>
> Set-Cookie: foo=bar; Origin
> 
> Using the Origin attribute sets the scope of the cookie to the current
> origin (scheme, host, and port).  The Origin attribute overrides the
> Domain and Path attributes.  Additionally, the cookie is returned to
> the server in the Origin-Cookie header:
> 
> Origin-Cookie: foo=bar
> 
> The reason we return the cookie in a separate header is so the server
> can know that the cookie was set by its own origin.  If we returned
> the cookie in the Cookie header, then an attacker could inject a
> non-Origin cookie with the same name and confuse the server.

Ok, so you are thinking about an extension to cookies instead of
a new cake mechanism.

> On Fri, Dec 3, 2010 at 12:02 PM, Mike Wilson 
> <mikewse@hotmail.com> wrote:
> > Earlier this year [1] we discussed state scoped on individual
> > windows or tabs:
> >
> > [...]
> >
> > I see that you have addressed CSRF in cakes. Were/are you thinking
> > that cakes is the better place to add future window scopes to?
> 
> Independently of the Origin attribute, I think an "instance" attribute
> make sense.  Here we'd want to follow the same scoping rules as
> sessionStorage (at the application layer).  In particular, each tab
> has a separate scope, but if one tab is created from another, it
> starts off with a clone of the previous tab's state.

I think more scopes than user_agent and browsing_context could be 
interesting so I would not go for a boolean attribute.
Anyway, is now a good time to start looking at these factors, or
is there other work you want to finish first?

Best regards
Mike

[http-state] cake spec: server-side initiation on… Mike Wilson
Re: [http-state] cake spec: server-side initiatio… Adam Barth
Re: [http-state] cake spec: server-side initiatio… Mike Wilson
Re: [http-state] cake spec: server-side initiatio… Adam Barth