Subject: [http-state] Draft for $Origin attribute published

From: "Yngve N. Pettersen (Developer Opera Software ASA)" <[email-masked]>
Date: Tue, 02 Mar 2010 00:31:14 +0100

Hello all,

I have submitted a draft describing the $Origin Cookie header attribute I  
suggested during the public suffix discussion earlier.

This document is based on the suggestion I've previously included in the  
Cookie-v2 draft.

----------------------
Filename:	 draft-pettersen-cookie-origin
Revision:	 00
Title:		 Identifying origin server of HTTP Cookies
Creation_date:	 2010-03-01
WG ID:		 Independent Submission
Number_of_pages: 7

Abstract:
HTTP Cookies, as originally defined by Netscape in [NETSC] andas
later updated by [RFC2109] and [RFC2965] left unaddressed the issue
of how to restrict which domains a server can set a cookie for, which
is particularly a problem for servers hosted in top level domains
have subdomains that are controlled by registries, not domain owners,
e.g. co.uk and city.state.us domains.  In such situations, unless the
client uses some kind of domain black-list it is possible for a
malicious server to set cookies that the client will send to all
servers in a domain the attacker does not control, and these cookies
may adversly affect the function of servers receiving them.  The
primary reason this is a problem is that the server receiving the
cookie have no way of telling which server originally set it, and is
therefore not able to reliably distinguish an invalid cookie from a
valid cookie.  This document proposes a new attribute, "$Origin",
that is associated with each cookie and sent in all the client's
Cookie header in the request to the server.  Servers recognizing the
attribute may then check to see if the cookie was set by a server
allowed to set cookies for the server, and if necessary ignore the
cookie.

http://tools.ietf.org/id/draft-pettersen-cookie-origin-00.txt

-- 
Sincerely,
Yngve N. Pettersen

********************************************************************
Senior Developer                     Email: [email-masked]
Opera Software ASA                   http://www.opera.com/
Phone:  +47 24 16 42 60              Fax:    +47 24 16 40 01
********************************************************************

---

From: "Yngve N. Pettersen (Developer Opera Software ASA)" <[email-masked]>
Date: Sun, 07 Mar 2010 20:44:55 +0100

Hello all,

A slightly edited version of the $Origin draft has been sumbitted.

http://www.ietf.org/id/draft-pettersen-cookie-origin-01.txt

-----------

A new version of I-D, draft-pettersen-cookie-origin-01.txt has been  
successfuly submitted by Yngve Pettersen and posted to the IETF repository.

Filename:	 draft-pettersen-cookie-origin
Revision:	 01
Title:		 Identifying origin server of HTTP Cookies
Creation_date:	 2010-03-07
WG ID:		 Independent Submission
Number_of_pages: 7

Abstract:
HTTP Cookies, as originally defined by Netscape in [NETSC] and as
later updated by [RFC2109] and [RFC2965] did not address the issue of
how to restrict which domains a server is allowed to set a cookie
for: This is particularly a problem for servers hosted in top level
domains having subdomains that are controlled by registries and not
by domain owners, e.g. co.uk and city.state.us domains.  In such
situations, unless the client uses some kind of domain black-list, it
is possible for a malicious server to set cookies so they are sent to
all servers in a domain the attacker does not control.  These cookies
may adversly affect the function of servers receiving them.  The
primary reason this is a problem is that the server receiving the
cookie has no way of telling which server originally set it, and is
therefore not able to reliably distinguish an invalid cookie from a
valid cookie.

This document proposes a new attribute, "$Origin", that is associated
with each cookie and sent in all client cookie headers in the
requests sent to the server.  Servers recognizing the attribute may
then check to see if the cookie was set by a server which is allowed
to set cookies for the server, and if necessary ignore the cookie.

-- 
Sincerely,
Yngve N. Pettersen