[http-state] Setting cookies for sibling domains (was Re: Security considerations overview)

[Adam Barth <[e-mail]>]

On Wed, Mar 3, 2010 at 3:38 PM, Mark Pauley <[e-mail]> wrote:
> It would appear that this is covered by 4.1.2.2
>
> We (and many other browsers) do allow setting a cookie with domain .bar.example.com from .foo.example.

Oh, I thought I tested that case.  Give me a few minutes to write a
test case for this behavior.

> Indeed, some web applications rely on this behavior.  The compromise is that we'll allow .foo.example.com to set a cookie for .bar.example.com if and only if .example.com is not a Top Level (or registry controlled) Domain.

I find that surprising, but that's why we have tests.  :)

Adam


> On Mar 3, 2010, at 3:32 PM, Mark Pauley wrote:
>
>> Excuse my ignorance, I've just recently joined this list.
>>
>> Is this the correct forum to enquire about what we refer to as the 'Cross Site Acceptance Policy'?  We (Safari / CFNetwork) by default refuse to set cookies from hosts from a domain tree outside of the current Top Level Domain tree.  That is from a host with name x1.x2.x3...x_k  we'll set a cookie with domain .y1.y2.y3...y_m if and only if y_m == x_k, y_m-1 == x_k-1, etc to y_m-n == x_k-n and y1....y_m-n is not a top level domain.
>>
>> That is, if the domain is at least a cousin; the target domain shares a common ancestor with the origin domain which is not a Top Level Domain.
>>
>> We've worked out that this is probably the most restrictive definition that will work given a good enough description of what a Top Level Domain is (which we have thanks to the Mozilla Top Level Domain list project).
>>
>>
>> _______________________________________________
>> http-state mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/http-state
>
> _______________________________________________
> http-state mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/http-state
>