Re: [http-state] Whether to recommend the cookie protocol (was Re: I-D Action:draft-ietf-httpstate-cookie-04.txt)

[David Morris <[e-mail]>]

On Wed, 24 Feb 2010, Adam Barth wrote:

> 
> [[
>       The cookie protocol has many
>       historical infelicities that degrade its security and privacy.
> ]]

Better, but I think 'infelicities' is not a common word and its use would 
make the docuemnt harder to read.

> 
> How do folks feel about this related statement in Security Considerations:
> 
> [[
>         <t>For applications that use the cookie protocol, servers SHOULD
>         NOT rely upon cookies for security.</t>
> ]]

Given that we are documenting an existing protocol, a SHOULD NOT statement
is probabaly excessive.

I think we should instead stress (and document those that are known) that
there are many opportunities to compromise the content of cookies 
including insertion of rogue cookies and/or removing valid cookies. Hence,
the design of applications which depend on cookies should carefully
consider the impact on application data integrity (and security) if
the cookie mechanism is subverted. In this context, I use application 
in the classic sense of a set of computer software which delivers some
form of service to people or other computer applications.