Subject: [http-state] Fwd: New Version Notification for draft-pettersen-cookie-v2-06

From: "Yngve N. Pettersen (Developer Opera Software ASA)" <[email-masked]>
Date: Mon, 14 Mar 2011 15:05:35 +0100

Hi,

I have now updated my suggestions for changing how the domain and path  
attributes work in cookies, so that the Cookie Monster Bug can be avoided.

Given that draft-ietf-httpstate-cookie-23 now replaces RFC 2965, I assume  
that any such changes need to be integrated into the system documented by  
draft-ietf-httpstate-cookie-23, not RFC 2965.

If so, and if we want to provide more information to the server about the  
cookies it receives, that probably means either using the proposed $foo  
parameter syntax from RFC 2109/2965, or defining some other mechanism to  
do the same.

This would also require a complete rewrite of this draft (which is based  
on RFC 2965), or replacing it with a new draft. I have not yet started  
such a rewrite, pending input about how we should proceed.

------- Forwarded message -------
From: "IETF I-D Submission Tool" <[email-masked]>
To: [email-masked]
Cc:
Subject: New Version Notification for draft-pettersen-cookie-v2-06
Date: Mon, 14 Mar 2011 14:52:41 +0100

A new version of I-D, draft-pettersen-cookie-v2-06.txt has been
successfully submitted by Yngve Pettersen and posted to the IETF
repository.

Filename:	 draft-pettersen-cookie-v2
Revision:	 06
Title:		 HTTP State Management Mechanism v2
Creation_date:	 2011-03-14
WG ID:		 Independent Submission
Number_of_pages: 31

Abstract:
This document specifies a way to create a stateful session with
Hypertext Transfer Protocol (HTTP) requests and responses.  It
describes three HTTP headers, Cookie, Cookie2, and Set-Cookie2, which
carry state information between participating origin servers and user
agents.  The method described here differs from both Netscape's
Cookie proposal [Netscape], and [RFC2965], but it can, provided some
requirements are met, interoperate with HTTP/1.1 user agents that use
Netscape's method.  (See the HISTORICAL section.)

This document defines new rules for how cookies can be shared between
servers within a domain.  These new rules are intended to address
security and privacy concerns that are difficult to counter for
clients implementing Netscape's proposed rules or the rules specified
by RFC 2965.

This document reflects implementation experience with RFC 2965 and
obsoletes it.

The IETF Secretariat.

-- 
Sincerely,
Yngve N. Pettersen
********************************************************************
Senior Developer		     Email: [email-masked]
Opera Software ASA                   http://www.opera.com/
Phone:  +47 23 69 32 60              Fax:    +47 23 69 24 01
********************************************************************