Re: [http-state] Ticket 6: host-only cookies

Dan Winship <> Fri, 22 January 2010 19:10 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 8BEDF3A6AA3 for <>; Fri, 22 Jan 2010 11:10:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.265
X-Spam-Status: No, score=-2.265 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id yzyu8poSRL-O for <>; Fri, 22 Jan 2010 11:10:03 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id 2A3143A672F for <>; Fri, 22 Jan 2010 11:10:03 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTPA id 481A1802AE; Fri, 22 Jan 2010 14:09:58 -0500 (EST)
Message-ID: <>
Date: Fri, 22 Jan 2010 14:09:57 -0500
From: Dan Winship <>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv: Gecko/20091209 Fedora/3.0-4.fc12 Thunderbird/3.0
MIME-Version: 1.0
To: Adam Barth <>
References: <> <> <>
In-Reply-To: <>
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
Cc: Daniel Stenberg <>, http-state <>
Subject: Re: [http-state] Ticket 6: host-only cookies
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Discuss HTTP State Management Mechanism <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 22 Jan 2010 19:10:08 -0000

On 01/22/2010 12:49 PM, Adam Barth wrote:
> In this case, we see that every non-IE user agent has decided to
> support host-only cookies.  Given the collective market share of these
> user agents, that's strong evidence that the behavior is sufficiently
> interoperable with existing servers.

In this case the problem isn't whether the client behavior is
interoperable with servers, it's whether the server behavior (of
expecting host-only cookies to actually be treated as host-only) is
interoperable with clients. And more than 50% of the time, it's not.

> Also, there is a large security
> benefit to implementing host-only cookies.

But there's a large security FAIL for servers if their security model
assumes that clients will implement host-only cookies, and then it turns
out that some clients don't. And since we already know that some
(/many/most) clients don't, sites that want to be secure have to find
some other way to protect themselves and their users that doesn't depend
on having working host-only cookies. (Because, as recently demonstrated,
hackers can do plenty of damage even if they can only hack IE users. :)

-- Dan