Re: [http-state] Welcome to http-state

On Mon, Jan 12, 2009 at 2:41 PM, Yngve N. Pettersen (Developer Opera
Software ASA) <yngve@opera.com> wrote:
> Please note that RFC2965 already have such integrity checking through the
> $Domain, $Path and $Port attributes.

Cool!

> It might be that $Secure should be added as well, but using Port="443"
> should already take care of that rather nicely.

Why is that?  It seems like an active network attack (which is the
kind of attacker we're trying to stop) can just fake an HTTP server on
port 443 and spoof that attribute.

> Also, my cookie-v2 draft suggest always sending the $Domain&Co parameters to
> allow servers to verify the domain of a cookie, and a $Origin attribute for
> v0 and v1 cookies to permit the receiver to know who set the cookie.

If you can tolerate the bandwidth, sending the ASCII serialization of
the origin (including the scheme) is a great idea.

Adam
_______________________________________________
http-state mailing list
http-state@ietf.org
https://www.ietf.org/mailman/listinfo/http-state