Subject: Re: [http-state] http-state charter (draft-pettersen-cookie-v2-04)

From: =JeffH <[email-masked]>
Date: Fri, 31 Jul 2009 02:00:17 -0700

This I-D probably ought to be listed/included in the charter from the get-go.

=JeffH

------- Forwarded Message

Date:    Sun, 05 Jul 2009 21:40:06 +0200
From:    "Yngve N. Pettersen (Developer Opera Software ASA)" <[email-masked]>
To:      "Discuss HTTP State Management Mechanism" <[email-masked]>
Subject: [http-state] Fwd: I-D Action:draft-pettersen-cookie-v2-04.txt

My suggestion for an update of RFC 2965 have been refreshed.

- ------- Forwarded message -------
From: [email-masked]
To: [email-masked]
Subject: I-D Action:draft-pettersen-cookie-v2-04.txt
Date: Sun, 05 Jul 2009 21:30:02 +0200

A New Internet-Draft is available from the on-line Internet-Drafts =20
directories.

	Title           : HTTP State Management Mechanism v2
	Author(s)       : Y. Pettersen
	Filename        : draft-pettersen-cookie-v2-04.txt
	Pages           : 30
	Date            : 2009-07-05

This document specifies a way to create a stateful session with
Hypertext Transfer Protocol (HTTP) requests and responses.  It
describes three HTTP headers, Cookie, Cookie2, and Set-Cookie2, which
carry state information between participating origin servers and user
agents.  The method described here differs from both Netscape's
Cookie proposal [Netscape], and [RFC2965], but it can, provided some
requirements are met, interoperate with HTTP/1.1 user agents that use
Netscape's method.  (See the HISTORICAL section.)

This document defines new rules for how cookies can be shared between
servers within a domain.  These new rules are intended to address
security and privacy concerns that are difficult to counter for
clients implementing Netscape's proposed rules or the rules specified
by RFC 2965.

This document reflects implementation experience with RFC 2965 and
obsoletes it.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-pettersen-cookie-v2-04.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

Sincerely,
Yngve N. Pettersen
=A0
********************************************************************
Senior Developer                     Email: [email-masked]
Opera Software ASA                   http://www.opera.com/
Phone:  +47 24 16 42 60              Fax:    +47 24 16 40 01
********************************************************************

_______________________________________________
I-D-Announce mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft directories: http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

_______________________________________________
http-state mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/http-state

------- End of Forwarded Message

---

From: Bil Corry <[email-masked]>
Date: Fri, 31 Jul 2009 09:53:27 -0500

> This I-D probably ought to be listed/included in the charter from the

Here is the list I have, does this cover everything to consider?  I can add this to the charter if it would be helpful.

Specifications, RFCs and Drafts to Consider:

Netscape Cookie Specification
http://curl.haxx.se/rfc/cookie_spec.html

RFC 2109 - HTTP State Management Mechanism (Obsoleted by RFC 2965)
http://tools.ietf.org/html/rfc2109

RFC 2964 - Use of HTTP State Management
http://tools.ietf.org/html/rfc2964

RFC 2965 - HTTP State Management Mechanism (Obsoletes RFC 2109)
http://tools.ietf.org/html/rfc2965

I-D - HTTP State Management Mechanism v2
http://tools.ietf.org/html/draft-pettersen-cookie-v2

I-D - Cookie-based HTTP Authentication
http://tools.ietf.org/html/draft-broyer-http-cookie-auth

Widely Implemented - HTTPOnly
http://www.owasp.org/index.php/HTTPOnly

- Bil