Subject: Re: [Add] Best practice on HTTP cookies in DoH

From: Alexander Dupuy <[email-masked]>
Date: Wed, 18 Dec 2019 14:35:29 -0500

Chris wrote:

> My impression is that unless there is a good reason to use one, the
> expected behaviour should be:
>
>    - Clients SHOULD NOT send cookies on DoH requests
>    - Servers SHOULD discard any cookies they receive on DoH requests
>    - Servers SHOULD NOT set cookies in DoH responses
>    - Clients SHOULD NOT accept cookies in DoH responses *(already stated
>    in RFC8484)*
>
> To provide even more disincentive to sending cookies, it might be
worthwhile for servers to go even further and reject queries that contain
cookies, as a disincentive to clients that are sending them:

   - Servers MAY reject DoH requests containing cookies

In the case where a DoH server rejects such a request, it could return an
appropriate HTTP error code (perhaps 431 Request Header Fields Too Large?)
with a message telling users and developers to use other clients that don't
send cookies or to fix the client being used.

However, there is a use case that may be broken by rejecting cookies, which
is that web applications (that is, Javascript/Typescript code running in a
browser web page context) may end up making DoH queries with cookies (since
there may be no way for them to prevent the browser from sending cookies)
and it would likely break curious users who make test DoH queries in their
browser if they have cookies set for the DoH server domain. To be clear,
this is not a use case that requires cookies, it is just a use case that
may not be able to avoid sending them in some environments.

To mitigate this, one could add an additional desiderata:

   - Servers SHOULD use dedicated domains that cannot potentially share
   cookies with web applications

(that is, it's not good enough to have a dedicated subdomain like
doh.example.com, since example.com cookies would still be in scope and
could be sent; instead use doh-example.com).

@alex

---

From: Rob Sayre <[email-masked]>
Date: Wed, 18 Dec 2019 14:16:45 -0800

>    - Servers MAY reject DoH requests containing cookies
All of these additional requirements are redundant, and are implied by the
requirement stated in RFC8484 and the security considerations of HTTP
itself (I looked at RFC7231).

thanks,
Rob