Subject: Re: [http-state] HTTP cookie processing wrt "public suffixes"

From: Zhong Yu <[email-masked]>
Date: Mon, 18 May 2015 09:44:02 -0500

There is a complication that is neither addressed in the RFC nor in
Jeff's document:

   - it's possible that the parent of a public suffix is not a public
suffix itself.

For example:  compute.amazonAws.com is a public suffix; but its
parent, amazonAws.com, is not a public suffix.

Obviously, we cannot allow `foo.compute.amazonAws.com` to set
cookie.domain=amazonAws.com, even though `amazonAws.com` is not a
public suffix.

To be fair, this situation should not have existed; it's bad enough
that companies spam the public suffix list with no discipline and
consideration; it's unconscionable that they introduce unnecessary
complications like this. /rant

Anyways, how do we handle this situation? The simplest solution is to
declare that all parents of a public suffix are public suffixes too.
However this might break existing deployments where a parent is a
"normal" website.

If we accept the reality that a parent of a public suffix may not be a
public suffix, the cookie domain algorithm needs to be a little more
sophisticated. We want to achieve the following effect:

1.  foo.compute.amazonAws.com cannot set a cookie for
compute.amazonAws.com or higher domains

2. w1.amazonAws.com can set a cookie for amazonAws.com, which affects
w2.amazonAws.com.
    however the cookie must not affect compute.amazonAws.com and its subdomains.

Zhong Yu
bayou.io

---

From: Zhong Yu <[email-masked]>
Date: Tue, 19 May 2015 11:35:31 -0500

Thanks Gerv, but we are talking about different things. In this
discussion, there is no dispute that "amazonaws.com" is-not a public
suffix, and "computer.amazonaws.com" is.

The question is, whether "foo.computer.amazonaws.com" can set a cookie
with domain "amazonaws.com". Obvious it should not be able to. And all
major browsers will deny it.

However, the letter of RFC6265 would have permitted it, because the
cookie domain "amazonaws.com" is not a public suffix.

There are two ways to address this problem:

1. fix RFC
2. fix PSL so that a parent of a public suffix is implicitly a public
suffix. (this is a little different from the discussion of "*" rules)

I think (2) is pretty reasonable. Domain names are cheap, a company
should just get a new domain for public suffix, instead of use a
subdomain.

Zhong Yu
bayou.io

On Tue, May 19, 2015 at 4:58 AM, Gervase Markham <[email-masked]> wrote:
> On 18/05/15 15:44, Zhong Yu wrote:
> See https://bugzilla.mozilla.org/show_bug.cgi?id=1139842 for the
> discussion of the PSL team on how to deal with the current ambiguous
> situation in the PSL.
>
> Gerv

---

From: Zhong Yu <[email-masked]>
Date: Tue, 19 May 2015 11:37:23 -0500

Here is a list of public suffix which has a parent that's not a public suffix:

                    compute.amazonaws.cn
         cn-north-1.compute.amazonaws.cn
                   compute.amazonaws.com
    ap-northeast-1.compute.amazonaws.com
    ap-southeast-1.compute.amazonaws.com
    ap-southeast-2.compute.amazonaws.com
      eu-central-1.compute.amazonaws.com
         eu-west-1.compute.amazonaws.com
         sa-east-1.compute.amazonaws.com
     us-gov-west-1.compute.amazonaws.com
         us-west-1.compute.amazonaws.com
         us-west-2.compute.amazonaws.com
                 compute-1.amazonaws.com
             z-1.compute-1.amazonaws.com
             z-2.compute-1.amazonaws.com
                       elb.amazonaws.com
                        s3.amazonaws.com
         s3-ap-northeast-1.amazonaws.com
         s3-ap-southeast-1.amazonaws.com
         s3-ap-southeast-2.amazonaws.com
              s3-eu-west-1.amazonaws.com
     s3-fips-us-gov-west-1.amazonaws.com
              s3-sa-east-1.amazonaws.com
          s3-us-gov-west-1.amazonaws.com
              s3-us-west-1.amazonaws.com
              s3-us-west-2.amazonaws.com
 s3-website-ap-northeast-1.amazonaws.com
 s3-website-ap-southeast-1.amazonaws.com
 s3-website-ap-southeast-2.amazonaws.com
      s3-website-eu-west-1.amazonaws.com
      s3-website-sa-east-1.amazonaws.com
      s3-website-us-east-1.amazonaws.com
  s3-website-us-gov-west-1.amazonaws.com
      s3-website-us-west-1.amazonaws.com
      s3-website-us-west-2.amazonaws.com
                 us-east-1.amazonaws.com
                         forgot.her.name
                         forgot.his.name
                       a.prod.fastly.net
                  global.prod.fastly.net
                        a.ssl.fastly.net
                        b.ssl.fastly.net
                   global.ssl.fastly.net
                         nes.akershus.no
                         nes.buskerud.no
                           os.hedmark.no
                        valer.hedmark.no
                 xn--vler-qoa.hedmark.no
                         os.hordaland.no
                heroy.more-og-romsdal.no
                sande.more-og-romsdal.no
                          bo.nordland.no
                       heroy.nordland.no
                   xn--b-5ga.nordland.no
                xn--hery-ira.nordland.no
                        valer.ostfold.no
                          bo.telemark.no
                   xn--b-5ga.telemark.no
                       sande.vestfold.no
         sande.xn--mre-og-romsdal-qqb.no
  xn--hery-ira.xn--mre-og-romsdal-qqb.no
          xn--vler-qoa.xn--stfold-9xa.no

---

From: Zhong Yu <[email-masked]>
Date: Tue, 19 May 2015 11:45:10 -0500

> Here is a list of public suffix which has a parent that's not a public suffix:

So the problem is quite limited at current time.

We can probably convince amazonaws.com/cn be a public suffix.

forgot.her/his.name seems defunct.

fastly.net seems defunct.

not sure about .no domains.

Zhong Yu
bayou.io

---

From: Zhong Yu <[email-masked]>
Date: Thu, 21 May 2015 18:30:17 -0500

After more thoughts on the matter, it seems not uncommon that a parent
of a public suffix is not a public suffix. Besides the domains listed
in my previous email, all "*" rules in PSL imply a public suffix with
a non-public-suffix parent. For example, rule "*.bd" means that any
"foo.bd" is a public suffix, but the parent, "bd", is not a public
suffix (because the public cannot directly register child domains of
"bd")

With this clarified, we'll have to fix RFC6265. Currently it allows
"bar.foo.bd" to set a cookie for domain "bd". That is incorrect; and
it is not how browsers behave. I'll see if I can find a simple
algorithm to address the problem.

Zhong Yu
bayou.io

---

From: Gervase Markham <[email-masked]>
Date: Tue, 19 May 2015 10:58:55 +0100

Gerv