Re: [http-state] Ticket 6: host-only cookies

[Dan Winship <[e-mail]>]

On 01/22/2010 12:49 PM, Adam Barth wrote:
> In this case, we see that every non-IE user agent has decided to
> support host-only cookies.  Given the collective market share of these
> user agents, that's strong evidence that the behavior is sufficiently
> interoperable with existing servers.

In this case the problem isn't whether the client behavior is
interoperable with servers, it's whether the server behavior (of
expecting host-only cookies to actually be treated as host-only) is
interoperable with clients. And more than 50% of the time, it's not.

> Also, there is a large security
> benefit to implementing host-only cookies.

But there's a large security FAIL for servers if their security model
assumes that clients will implement host-only cookies, and then it turns
out that some clients don't. And since we already know that some
(/many/most) clients don't, sites that want to be secure have to find
some other way to protect themselves and their users that doesn't depend
on having working host-only cookies. (Because, as recently demonstrated,
hackers can do plenty of damage even if they can only hack IE users. :)

-- Dan