Resent-Date: Mon, 09 Mar 2020 22:03:51 +0000
Resent-Message-Id: <E1jBQV5-0006aW-ES@lyra.w3.org>
User-Agent: Cyrus-JMAP/3.1.7-991-g5a577d3-fmstable-20200305v3
Mime-Version: 1.0
Message-Id: <110aa602-33bd-4fbf-b3af-c5530d95fc44@www.fastmail.com>
In-Reply-To: 
 <CAKXHy=d260V9_63yNBwLjDG=upZ+HG3iJ8hKbnFc0KU7fCbVcQ@mail.gmail.com>
References: 
 <CAKXHy=d260V9_63yNBwLjDG=upZ+HG3iJ8hKbnFc0KU7fCbVcQ@mail.gmail.com>
Date: Tue, 10 Mar 2020 09:02:25 +1100
From: "Martin Thomson" <mt@lowentropy.net>
To: ietf-http-wg@w3.org
Content-Type: text/plain
Received-SPF: pass client-ip=66.111.4.26; envelope-from=mt@lowentropy.net;
 helo=out2-smtp.messagingengine.com
Subject: Re: Cookies and schemes.
Archived-At: =?utf-8?q?=3Chttps=3A//www=2Ew3=2Eorg/mid/110aa602-33bd-4fbf-b3?=
 =?utf-8?q?af-c5530d95fc44=40www=2Efastmail=2Ecom=3E?=
Resent-From: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list

On Mon, Mar 9, 2020, at 19:51, Mike West wrote:
> https://github.com/mikewest/scheming-cookies proposes two changes:
> 
> 1. We teach cookies about schemes, and lock them to the scheme that set 
> them (just like every other web-facing storage mechanism).

Excellent!

To Willy's point about transfer, perhaps we can allow any cookies that are set on an http:// response to follow a redirect to https://  The Sec-Nonsecure-Cookie header field seems like it might not be great long term.

Tf the goal is to support temporally-constrained transfer, then binding the cookies to the redirect avoids pulling from previous state.  Also, the redirector could have just packed this information into the target URL, so it's not a new tracking vector.

Have I missed a key piece of information?  Willy, could this work in the cases you understand?

> 2. We curtail non-secure schemes' cookies' lifetime by agreeing on a 
> set of heuristics for a user's "session" on a given site, and culling 
> cookies when a site's session expires.

Also good.  The need for heuristics is unfortunate, but I appreciate that you have to do that.