Subject: Interop issue: Can we require clients to accept cookies?

From: "Lisa Dusseault" <[email-masked]>
Date: Sun, 15 Sep 2002 11:13:50 -0700

RFC 2518 is silent on cookies.  It requires support for RFC2068 (now
RFC2616), but does not reference the HTTP Cookie RFC (RFC 2965).

Some WebDAV servers, however, rely on setting cookies to keep a session
for an unauthenticated user. For Basic authentication, cookies can
vastly reduce the number of times a nearly-clear-text password is sent
over the network, so cookies can make the interaction more secure.
Session cookies are less secure than Digest authentication, however
servers with low security requirements and high performance requirements
may prefer to use cookies.

In addition to being used for keeping sessions, cookies may be used to
keep track of other client preferences (this is theoretical as I do not
know of any actual examples).

Thus, it was proposed that RFC2518 bis reference RFC2965, and say that
"clients SHOULD support cookies". 

Discuss?
Lisa

---

From: Joe Orton <[email-masked]>
Date: Mon, 16 Sep 2002 11:10:44 +0100

> "clients SHOULD support cookies". 

I'd strongly oppose that and hope the DAV spec remains silent on cookie
support.  There is a whole section in RFC2964 discouraging the use of
cookies as an authentication mechanism.

Regards,

joe

---

From: Stefan Eissing <[email-masked]>
Date: Mon, 16 Sep 2002 10:44:00 +0200

> "clients SHOULD support cookies".

I think we agree that a server should not depend on the client
handling cookies. WebDAV needs to function without them.

Therefore the spec should not mention them. I see the risk that
servers or client implementors might be tempted to rely on it.

It is certainly a good idea to collect implementation advice in
some FAQ or the webdav book of why.

//Stefan

---

From: Elias Sinderson <[email-masked]>
Date: Mon, 16 Sep 2002 16:45:29 -0700

Lisa Dusseault wrote:

>RFC 2518 is silent on cookies.... it was proposed that RFC2518 bis ... say that
I generally agree with the previous posts in this thread - against 
cookies, or at least the language above being included in RFC2518 bis. 
Aside from the other reasons brought up previously, cookies break the 
REST architectural model. Rather than further entrench their use, it 
would be nice for WebDAV to help move HTTP away from the use of cookies.

Elias

---

From: Dan Brotsky <[email-masked]>
Date: Tue, 17 Sep 2002 01:13:04 -0700

>> "clients SHOULD support cookies".

I also strongly oppose any mention of cookies, and would vehemently 
oppose any proposal that clients SHOULD support cookies with WebDAV.  
In addition to all the very good arguments mentioned so far, I would 
add that the cookie spec *requires* providing explicit user control of 
the use of cookies.  This means that clients which support cookies have 
to support a whole bunch of UI that has arguably nothing to do with 
distributed authoring, either complicating their user model or forcing 
them to tie together the use of their client with the use of a browser 
(where cookie control UI typically lives).

By the way, Adobe has yet to test against a WebDAV server that does 
cookie-based authentication that did not (in our view) start out with 
some serious security holes.  Even our own implementations, for use 
with servers that provided Web-based UIs, took months to get to a 
reasonably-secure place.

If I were to advocate that the spec say anything about cookies, it 
would be that servers SHOULD NOT use cookies as an authentication 
mechanism.

     dan