Subject: Re: [http-state] HTTP cookie processing wrt "public suffixes"

From: Zhong Yu <[email-masked]>
Date: Fri, 5 Jun 2015 17:28:27 -0500

I've written an article explaining cookie domain and public suffix, in
which I propose a simple mode that seems very sensible -

A cookie domain's coverage set is defined as:
- the set contains the cookie domain
- if the set contains x, and x is not a public suffix, the set contains all
direct subdomains of x.

Testing the coverage - A cookie domain must cover the request domain
- when the cookie is received
- when the cookie is applied to a request

Basically, a cookie domain can bet set by any domain in the coverage set;
and the cookie is applicable to all domains in the coverage set.

See http://bayou.io/draft/cookie.domain.html#Coverage_Model

Zhong Yu
bayou.io