Subject: HttpOnly

From: Jim Manico <[email-masked]>
Date: Tue, 18 Mar 2008 07:20:31 +0000

Are there any efforts underway to support the HttpOnly cookie directive 
within any version of the HTTP Protocol?

The HttpOnly cookie flag, now supported or soon to be supported by all 
major browser vendors, is a significant security enhancement for web 
centric computing. The HttpOnly flag simply prevents JavaScript from 
reading the details of a cookie. In particular, adding this flag to the 
HTTP spec as an /optional/ cookie directive will go a long way in 
assisting in the mitigation of Cross Site Scripting (XSS) and other 
session hijacking attack vectors.

With respect + Best Regards,
Jim Manico
[email-masked]
Application Security Engineer + Web Application Architect

---

From: Daniel Stenberg <[email-masked]>
Date: Tue, 18 Mar 2008 10:33:13 +0100 (CET)

> within any version of the HTTP Protocol?

1 - Cookies aren't included in RFC2616 at all.

2 - Hardly any implemenations of cookies follow any recent attempts to
     document how cookies should be handled so I doubt writing yet another
     cookie spec update will help much.

Given the history of cookies so far, they are doomed to be adhoc'ed and work 
in a random undocumented fashion... (unless you count the original Netscape 
cookie document a specification).