Subject: Re: [httpwg/http-extensions] httpbis-cookie-alone breaks backwards compat (#223)

From: HTTP issue updates <[email-masked]>
Date: Mon, 05 Sep 2016 00:38:31 -0700

> If I had to deal with that scenario, I'd probably just focus more on HSTS instead to avoid those cookie related headaches.

Doesn't that seem like a good outcome?

> Mike, you said yourself that you feel like path-level distinctions in cookies was a historical mistake,

The fact that I consider path-level distinctions for cookies to be a mistake (and I do) doesn't mean that I can pretend they don't exist. I'm doing my best to work within the constraints they create to incrementally raise the platform's baseline. *shrug*

> so wouldn't opt-in mechanisms (HSTS, Cookie-Attributes, Suborigins, etc) be better long-term than allowing the cookie path-match algorithm to further dictate how servers organize content?

Yes. When we can create opt-in mechanisms that allow sites to lock themselves down further than we can lock down the platform at large, we should.

However, relying strictly upon those mechanisms is unlikely to produce actual change in the ecosystem. For instance, despite fairly broad outreach and understanding, something like ~4% of the cookies Chrome users set in the last month have the `Secure` attribute. ~7% have `HttpOnly`. I think it's pretty clear that, in an ideal world, those numbers would be an order of magnitude higher.

It seems unlikely than an opt-in approach would buy us much in terms of protection, especially when the opt-in is fairly complicated, as `Cookie-Attributes` would be.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/223#issuecomment-244678287

---

From: HTTP issue updates <[email-masked]>
Date: Thu, 08 Sep 2016 02:37:16 -0700

With the -01 draft published, and Chrome updated (in https://github.com/dstockwell/chromium/commit/2c857fb16cdef9783ba3caeb586b9a3648114b17), I think it's reasonable to close this out. We can continue the discussion of the other proposed paths forward (`Cookie-Attributes`, etc) on the list.

Thanks again for your feedback, @dvdckl!

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/223#issuecomment-245545626

---

From: HTTP issue updates <[email-masked]>
Date: Thu, 08 Sep 2016 02:37:16 -0700

Closed #223.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/223#event-782126496