Re: [http-state] HTTP cookie processing wrt "public suffixes"

[Zhong Yu <[e-mail]>]

After more thoughts on the matter, it seems not uncommon that a parent
of a public suffix is not a public suffix. Besides the domains listed
in my previous email, all "*" rules in PSL imply a public suffix with
a non-public-suffix parent. For example, rule "*.bd" means that any
"foo.bd" is a public suffix, but the parent, "bd", is not a public
suffix (because the public cannot directly register child domains of
"bd")

With this clarified, we'll have to fix RFC6265. Currently it allows
"bar.foo.bd" to set a cookie for domain "bd". That is incorrect; and
it is not how browsers behave. I'll see if I can find a simple
algorithm to address the problem.

Zhong Yu
bayou.io