Subject: Re: HTTPOnly Cookies Specification

From: Bil Corry <[email-masked]>
Date: Fri, 12 Dec 2008 11:14:46 -0600

Bil Corry wrote on 11/20/2008 4:41 PM: 
> Out of that, we started a group to discuss and create the HTTPOnly
> cookie specification.

Just an update, we have a draft of the HTTPOnly scope now available to review:

	http://docs.google.com/View?docid=dxxqgkd_0cvcqhsdw

If you have an active interest in participating, our list is here:

	http://groups.google.com/group/ietf-httponly-wg

- Bil

---

From: Bil Corry <[email-masked]>
Date: Tue, 16 Dec 2008 19:22:01 -0600

Dan Winship wrote on 11/21/2008 7:04 AM: 
> What would really be useful would be for someone to pull an HTML5 on
> cookies, documenting how they are actually parsed (ie, not like the
> Netscape spec or either RFC says), how the path and domain parameters
> are actually used (ie, not like the Netscape spec or either RFC says), etc.

I've gotten similar feedback elsewhere:

	http://groups.google.com/group/mozilla.dev.security/browse_thread/thread/f2e661f222366cdd#msg_07d98bee9cb6fdc5

So what's required to start a cookie WG here at IETF?

I'd imagine the first task would be to identify the various behaviors browsers should have based on the RFCs, then identify the behaviors the browsers actually have.  Do I only test using the latest versions of the browsers?  Or include older versions?  If older versions, which ones?  And which browsers?

- Bil

---

From: Julian Reschke <[email-masked]>
Date: Wed, 17 Dec 2008 14:49:41 +0100

> So what's required to start a cookie WG here at IETF?

Usually, a WG starts with a BOF at an IETF meeting:

   <http://www.ietf.org/ietf/1bof-procedures.txt>

The Area Directors to ask would be Lisa Dusseault or Chris Newman.

That being said, RFCs do not need to come out of WGs. So it may be 
sufficient to collect sufficiently interested people (hopefully with 
representatives of the browser vendors), and to conduct the development 
on an IETF mailing list

> ...

BR, Julian

---

From: Bil Corry <[email-masked]>
Date: Wed, 17 Dec 2008 09:38:49 -0600

> representatives of the browser vendors), and to conduct the development

Thanks, I've sent an email to Lisa Dusseault (which Ian Hickson also suggested I contact), and I'll proceed from there.

- Bil