Re: [http-state] Ticket 6: host-only cookies

Dan Winship <dan.winship@gmail.com> Fri, 22 January 2010 19:10 UTC

Return-Path: <dan.winship@gmail.com>
X-Original-To: http-state@core3.amsl.com
Delivered-To: http-state@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8BEDF3A6AA3 for <http-state@core3.amsl.com>; Fri, 22 Jan 2010 11:10:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.265
X-Spam-Level:
X-Spam-Status: No, score=-2.265 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yzyu8poSRL-O for <http-state@core3.amsl.com>; Fri, 22 Jan 2010 11:10:03 -0800 (PST)
Received: from mysterion.org (mysterion.org [69.25.196.35]) by core3.amsl.com (Postfix) with ESMTP id 2A3143A672F for <http-state@ietf.org>; Fri, 22 Jan 2010 11:10:03 -0800 (PST)
Received: from desktop.home.mysterion.org (c-76-97-71-164.hsd1.ga.comcast.net [76.97.71.164]) by mysterion.org (Postfix) with ESMTPA id 481A1802AE; Fri, 22 Jan 2010 14:09:58 -0500 (EST)
Message-ID: <4B59F805.8060508@gmail.com>
Date: Fri, 22 Jan 2010 14:09:57 -0500
From: Dan Winship <dan.winship@gmail.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.5) Gecko/20091209 Fedora/3.0-4.fc12 Thunderbird/3.0
MIME-Version: 1.0
To: Adam Barth <ietf@adambarth.com>
References: <7789133a1001220050m56cc438x35099b7972639331@mail.gmail.com> <alpine.DEB.2.00.1001220957240.9467@tvnag.unkk.fr> <7789133a1001220949l24c0f774t7ff0f0ab10a3dfa4@mail.gmail.com>
In-Reply-To: <7789133a1001220949l24c0f774t7ff0f0ab10a3dfa4@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Cc: Daniel Stenberg <daniel@haxx.se>, http-state <http-state@ietf.org>
Subject: Re: [http-state] Ticket 6: host-only cookies
X-BeenThere: http-state@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Discuss HTTP State Management Mechanism <http-state.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/http-state>, <mailto:http-state-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/http-state>
List-Post: <mailto:http-state@ietf.org>
List-Help: <mailto:http-state-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/http-state>, <mailto:http-state-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 22 Jan 2010 19:10:08 -0000

On 01/22/2010 12:49 PM, Adam Barth wrote:
> In this case, we see that every non-IE user agent has decided to
> support host-only cookies.  Given the collective market share of these
> user agents, that's strong evidence that the behavior is sufficiently
> interoperable with existing servers.

In this case the problem isn't whether the client behavior is
interoperable with servers, it's whether the server behavior (of
expecting host-only cookies to actually be treated as host-only) is
interoperable with clients. And more than 50% of the time, it's not.

> Also, there is a large security
> benefit to implementing host-only cookies.

But there's a large security FAIL for servers if their security model
assumes that clients will implement host-only cookies, and then it turns
out that some clients don't. And since we already know that some
(/many/most) clients don't, sites that want to be secure have to find
some other way to protect themselves and their users that doesn't depend
on having working host-only cookies. (Because, as recently demonstrated,
hackers can do plenty of damage even if they can only hack IE users. :)

-- Dan