Re: [http-state] Welcome to http-state

Adam Barth wrote:
> I'm not an expert on what is or is not in scope for this working
> group

We're not actually a working group yet, so we don't have a charter, so
nothing is specifically in or out of scope yet.

The deliverable that some people want is an Informational RFC explaining
how cookies are actually used *right now* (as opposed to "how we wish
they worked"), with notes on areas of incompatibility, and discussion of
known security problems.

If we want to actually make cookies better, then we need to be careful
to not just create yet-another-improved-cookie-spec-that-everyone-
ignores (as Daniel Stenberg already noted). So there are two kinds of
things we can do:

    * Find ways to make cookies better that don't require web developers
      to change their behavior. (Eg, draft-pettersen-dns-cookie-validate
      and draft-pettersen-subtld-structure.)

    * Find ways to make cookies better that we can somehow force/trick/
      bribe web developers into using.

One way to make the new spec compelling might be to add some feature
that would be needed by some other useful spec like
Cookie-based-HTTP-auth (draft-broyer-http-cookie-auth, currently being
discussed on the ietf-http-auth list). Or to have new cookies integrate
with HTML5 in some exciting way that old cookies wouldn't be able to.

Likewise, even though it would be cleaner to scrap Set-Cookie and
replace it with a new header a la Set-Cookie2, developers are going to
want backward-compatibility, and don't want to have to set each cookie
twice (for bandwidth reasons), so the best solution for new features may
be to add new attributes to Set-Cookie (keeping in mind that old
implementations would still see the cookies but would ignore the new
attributes).

-- Dan
_______________________________________________
http-state mailing list
http-state@ietf.org
https://www.ietf.org/mailman/listinfo/http-state