Re: [saag] Input for conflict review of draft-secure-cookie-session-protocol

[Thomas Fossati <[e-mail]>]

Hi Mark,

On Mon, Oct 22, 2012 at 11:31 PM, Mark Nottingham <[e-mail]> wrote:
>
> As far as I can tell, this document specifies some extensions to the Cookie / Set-Cookie (RFC6265),

SCS doesn't define any extension whatsoever.  It just specifies a
format for what 6265 already identifies as a security need for "plain"
cookies. From RFC 6265, Section 8.3.:

   Servers SHOULD encrypt and sign the contents of cookies (using
   whatever format the server desires) when transmitting them to the
   user agent (even when sending the cookies over a secure channel).

> and/or "squats" on some pre-defined cookie names.

No name squatting: ANY_COOKIE_NAME in Section 3.3. of SCS is just a
placeholder which really means what it says: any name the cookie maker
decides to uses.

> 6265 doesn't define how it's to be extended very well (possibly because the underlying assumption is that extensions are VERY difficult to deploy).

Sorry if I sound like a broken record, but I want to be ultra-clear on
this point: SCS is not an extension to the cookie exchange; and in
fact it works out of the box -- today and since 6 years now -- on any
browser with cookies enabled.

Cheers, Thomas.