Re: [http-state] Seeking feedback on Security Considerations

[Achim Hoffmann <[e-mail]>]

Silly question about the used terms (sse partial quote below also):

  Sometimes the text refers to "application", sometimes to "server".

Currently cookies, in particular the cookie protocol, are handled mainly
by servers, but the cookie and its value (key-value pair) are used by
the application (or the framework there). And the application is where
all the secrity issues occour!

Without going into the precise definition where technically the server
ends and the application begins, I'd recommend that these two terms are
used interchangable. Should be mentioned somewhere.

Does this make sense?
Achim

>    The cookie protocol is NOT RECOMMENDED for new applications.
> 
>    For applications that do use the cookie protocol, servers SHOULD NOT
>    rely upon cookies for security.
> 
>    For servers that do use cookies for security, servers SHOULD use a
>    redundant form of authentication, such as HTTP authentication or TLS
>    client certificates.