Re: [http-state] Seeking feedback on Security Considerations

[Dan Winship <[e-mail]>]

On 02/13/2010 03:01 AM, Adam Barth wrote:
> 7.3.  Clear Text

>    In addition to encrypting and signing the contents of every cookie,
>    servers that require a higher level of security SHOULD use the cookie
>    protocol only over a secure channel.

Should probably mention the problem of having to explicitly set the
"Secure" flag too.

> 7.4.  Weak Confidentiality

>    Cookies do not provide isolation by port. 
>    Cookies do not provide isolation by scheme.

Also path.

>    Although most commonly
>    used with the http and https schemes, the cookies for a given host
>    are also available to other schemes, such as ftp and gopher.

Do we know that this is consistent across browsers? Should have some
tests for that. If it's not, we can just change "are also available" to
"may also be available" though.

>    This
>    lack of isolation is most easily seen when a user agent retrieves a
>    URI with a gopher scheme via HTTP, but the lack of isolation by
>    scheme is also apparent via non-HTTP APIs that permit access to
>    cookies, such as HTML's document.cookie API.

I think retrieving an HTML+javascript page via ftp is about a zillion
times more "easily seen" than anything involving gopher. :)

-- Dan