Subject: Re: [http-state] IETF-wide Last Call for -httpstate-cookie-10 ?

From: =JeffH <[email-masked]>
Date: Thu, 26 Aug 2010 10:31:26 -0700

> Respectfully as follows...
 >
 > http://www.ietf.org/mail-archive/web/http-state/current/msg00925.html
 >
 >> There've been no comments wrt -10 on the list since then.[snip]
 >>
 >>http://tools.ietf.org/rfcdiff?url2=draft-ietf-httpstate-cookie-10.txt
 >>
 >> Are there any objections to progressing -httpstate-cookie-10 to
 >> IETF-wide last call?
 >
 > I do not know where to submit objections, so I will submit them here and
 > please make sure they get relayed

yes this is the correct list to use, thanks for your comments.

 > 1) 4.1.2.6.  The HttpOnly Attribute.  I propose that we need also NoHttp
 > Attribute, which would be the inverse case of HttpOnly.

Please note that this spec, draft-ietf-httpstate-cookie, is specifically in 
regards to how cookies are implemented/processed on the Web /today/. It is 
explicitly /not/ about introducing any new functionality into the present 
model. This should be clear from reading -httpstate-cookie (the spec).

 > 2) 5.3.  Storage Model. Please recommend that HTTPS cookies be stored
 > encrypted (it can't hurt):
 >
 > https://bugzilla.mozilla.org/show_bug.cgi?id=588704

This is something that could be added to the security considerations section in 
some fashion, if the WG agrees.

 > 3) 6.2.  Application Programming Interfaces.  Please change "Instead of"
 > to "In addition to".  Never should semantic APIs be a restriction of the
 > general capability. Please!

You're apparently referring to 2nd para of sec 6.2. I'm personally fine with 
the wording and sentiment of the statements there. again WG would have to 
consider any changes.

 > 4) 8.7.  Reliance on DNS. If browsers properly implement per website
 > self-signed certificates:
 >
 > https://bugzilla.mozilla.org/show_bug.cgi?id=588704#c47

The reply to your point (1) applies here too.

thanks,

=JeffH