Subject: Re: HttpOnly

From: "Jim Manico" <[email-masked]>
Date: Tue, 18 Mar 2008 19:55:44 +0000

> 1 - Cookies aren't included in RFC2616 at all.

> 2 - Hardly any implemenations of cookies follow any recent attempts to

>     document how cookies should be handled so I doubt writing yet
another

>     cookie spec update will help much.

Daniel, 

What about http://www.ietf.org/rfc/rfc2965 ?

 

Jim Manico, Senior Application Security Engineer

[email-masked] <mailto:[email-masked]> 

(301) 604-4882 (work) 

(808) 652-3805 (cell) 

Aspect Security(tm)

Securing your applications at the source
<http://aspectsecurity.com/about.html>  

http://www.aspectsecurity.com <http://www.aspectsecurity.com>

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 19 Mar 2008 09:35:51 +0100

> What about http://www.ietf.org/rfc/rfc2965 ?

That is exactly what Daniel was talking about -- a standards-track  
spec that never made it into real life.

I think this needs to be marked as historic.
I also think the actual practice should be documented, and httponly is  
starting to become a part of that actual practice.

Gruesse, Carsten