Subject: [http-state] same domain, different port number

From: Daniel Stenberg <[email-masked]>
Date: Fri, 21 Aug 2009 11:51:55 +0200 (CEST)

Hi

The draft doesn't at all mention what happens if Alice and Bob run one web 
server each on the same domain D, but on different ports. (Common in NAT and 
port-forwarding scenarios.)

Is there any browser or server that take the port number into account at all 
for cookies? Could they even? Is there anything that prevent Alice and Bob 
from setting and reading each others cookies? I guess a recommendation is then 
to not use the same domain even for this kind of setup.

A little detail to mention somewhere at least.

-- 

  / daniel.haxx.se

---

From: "Yngve N. Pettersen" <[email-masked]>
Date: Fri, 21 Aug 2009 17:11:19 +0200

On Fri, 21 Aug 2009 11:51:55 +0200, Daniel Stenberg <[email-masked]> wrote:

> Hi
>
> The draft doesn't at all mention what happens if Alice and Bob run one  
> web server each on the same domain D, but on different ports. (Common in  
> NAT and port-forwarding scenarios.)
>
> Is there any browser or server that take the port number into account at  
> all for cookies? Could they even? Is there anything that prevent Alice  
> and Bob from setting and reading each others cookies? I guess a  
> recommendation is then to not use the same domain even for this kind of  
> setup.
>

Only RFC 2965 cookies (Set-Cookie2) can handle that type of situation with  
the port attribute

-- 
Sincerely,
Yngve N. Pettersen

********************************************************************
Senior Developer                     Email: [email-masked]
Opera Software ASA                   http://www.opera.com/
Phone:  +47 24 16 42 60              Fax:    +47 24 16 40 01
********************************************************************

---

From: Adam Barth <[email-masked]>
Date: Fri, 21 Aug 2009 09:34:00 -0700

I've added a TODO to the security consideration section to discuss
that there is no port-based isolation.

Adam

On Fri, Aug 21, 2009 at 2:51 AM, Daniel Stenberg<[email-masked]> wrote:
> from setting and reading each others cookies? I guess a recommendation is
> then to not use the same domain even for this kind of setup.
>
> _______________________________________________
> http-state mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-state
>