Subject: [http-state] future window scope based on cakes?

From: Mike Wilson <[email-masked]>
Date: Fri, 3 Dec 2010 21:02:02 +0100

Hi Adam,

Earlier this year [1] we discussed state scoped on individual 
windows or tabs:

Mike Wilson wrote:
> Adam Barth wrote:
> >  Set-Cookie: ... Scope=browsing_context; ...
> >
> > that would cause the user agent to only send this cookie for the
> > specified scope (here: browsing context  = window or tab) that
> > received it.
> >
> > The Scope parameter could be a general mechanism specified by the
> > cookie spec, possibly with allowed values specified in other
> > specs more applicable to each host environment.
> 
> This sounds like an interesting idea.  In a future version of the
> cookie protocol, we should consider a cookie scope akin to the scope
> used by sessionStorage in HTML5.  Ideally, we'd find a way of defining
> a scope that helps mitigate CSRF vulnerabilities at the same time.

I see that you have addressed CSRF in cakes. Were/are you thinking 
that cakes is the better place to add future window scopes to?

Best regards
Mike Wilson

[1] http://www.ietf.org/mail-archive/web/http-state/current/msg00797.html