Re: [http-state] Welcome to http-state

> I don't understand what you mean by "actively asserts."  My point is
> that a browser cannot do this with the current headers without a
> unbounded amount of storage.

When the user agent sends a Content-Integrity header it is actively
asserting the cookie's integrity level. Regarding storage, we've gone
full circle on this one. I'm thinking our time might be better served if
we spent 15 mins on the phone to talk this through. That, or shoot me
additional information on the storage-based implications you are
referring to. I would appreciate the education. If you have some time to
discuss this, give me a call any time at (206) 384 3023 or shoot me your
number and a good time to call you.

> How would you know if you've encountered instance of this pattern?  

I would have hopefully logged an improper session termination bug
against one of the sites I had performed security testing on. If the
logout handler operates over HTTP and the session ID is stuffed in a
Secure cookie then the logout handler would have no idea which session
it should terminate because it would not have access to the session ID.
This would result in a lingering session. I don't recall writing about
an improper session termination bug that was manifest due to the logout
handler being exposed over HTTP vice HTTPS. Again, my experience does
not mean this pattern isn't implemented all over the place.

Blake
_______________________________________________
http-state mailing list
http-state@ietf.org
https://www.ietf.org/mailman/listinfo/http-state