Subject: Origin cookies, and First-party cookies.

From: Mike West <[email-masked]>
Date: Fri, 21 Nov 2014 17:57:15 +0100

Hello, ietf-http-wg folks!

I posted two cookie-related drafts before the HNL meeting, which I hope
some of you took a few moments to skim through: origin cookies[1] (an
update of Adam Barth's "Cake"), and first-party cookies[2] (cookies which
are sent iff the top-level browsing context would have received them).

Did you skim through the proposals? Do you have opinions? I hope the answer
to both questions is yes! :)

It's not clear to me whether this group is the right place to work on those
concepts, but it seems like a good place to start. Also, I have to admit
that I'm an IETF newbie; I don't know the process or procedure for deciding
this kind of thing. Mark, can you help out a bit?

Thanks!

[1]: https://tools.ietf.org/html/draft-west-origin-cookies-00
[2]: https://tools.ietf.org/html/draft-west-first-party-cookies-00

--
Mike West <[email-masked]>
Google+: https://mkw.st/+, Twitter: @mikewest, Cell: +49 162 10 255 91

Google Germany GmbH, Dienerstrasse 12, 80331 München, Germany
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg
Geschäftsführer: Graham Law, Christine Elizabeth Flores
(Sorry; I'm legally required to add this exciting detail to emails. Bleh.)

---

From: Yoav Nir <[email-masked]>
Date: Fri, 21 Nov 2014 22:49:38 +0200

Hi, Mike

Not Mark, but I think I can give you some info.

We tried to get a “cookie replacement” discussion going at websec. Here’s a good summary of the proposals by Trevor Perrin:
http://www.ietf.org/mail-archive/web/websec/current/msg01719.html <http://www.ietf.org/mail-archive/web/websec/current/msg01719.html>

You can add your ideas to the list, as well as Andrei Popov’s  Token Binding <http://www.ietf.org/proceedings/91/slides/slides-91-uta-2.pdf>

So where’s the place to discuss this?  WebSec as a working group is closing down in a couple of months. The mailing list might stay in place if there’s meaningful discussion going on there. Currently, there is not. 

This mailing list is for discussing current work items for httpbis: HTTP/2, Alt-Svc, etc.  A little discussion of related “homeless” topics is usually tolerated as long as there is a small amount of traffic that does not distract people from the on-topic discussions.

Your proposal (and Andrei’s) have one important thing that the authors of proposals in the previous round didn’t: the people behind them (you and Andrei) actually work on browsers, so your proposals might get implemented. That’s a good start.

So, for starters it’s OK to start the discussion here. If it picks up steam, then you can have a conversation with Mark and Barry (our area director) about whether this activity should continue on this mailing list, move to some other mailing list (token binding is currently discussed in UTA) or start its own mailing list. When (and if) things seem to be converging (on a list of requirements and 1 or more proposals) then we can have the discussion again about what working group should handle this: httpbis, uta or a new working group.

But start with showing that there is interest.

Hope this helps

Yoav

> On Nov 21, 2014, at 6:57 PM, Mike West <[email-masked]> wrote:
> 
> I posted two cookie-related drafts before the HNL meeting, which I hope some of you took a few moments to skim through: origin cookies[1] (an update of Adam Barth's "Cake"), and first-party cookies[2] (cookies which are sent iff the top-level browsing context would have received them).
> 
> Did you skim through the proposals? Do you have opinions? I hope the answer to both questions is yes! :)
> 
> It's not clear to me whether this group is the right place to work on those concepts, but it seems like a good place to start. Also, I have to admit that I'm an IETF newbie; I don't know the process or procedure for deciding this kind of thing. Mark, can you help out a bit?
> 
> Thanks!
> 
> [1]: https://tools.ietf.org/html/draft-west-origin-cookies-00 <https://tools.ietf.org/html/draft-west-origin-cookies-00>
> [2]: https://tools.ietf.org/html/draft-west-first-party-cookies-00 <https://tools.ietf.org/html/draft-west-first-party-cookies-00>
> 
> --
> Mike West <[email-masked] <mailto:[email-masked]>>
> Google+: https://mkw.st/+ <https://mkw.st/+>, Twitter: @mikewest, Cell: +49 162 10 255 91
>

---

From: Martin Thomson <[email-masked]>
Date: Fri, 21 Nov 2014 14:38:25 -1000

On 21 November 2014 10:49, Yoav Nir <[email-masked]> wrote:
> We tried to get a “cookie replacement” discussion going at websec. Here’s a
> good summary of the proposals by Trevor Perrin:
> http://www.ietf.org/mail-archive/web/websec/current/msg01719.html

The first of these proposals (and token ID) are actually already on
trevor's list.  Origin cookies are an evolution of cake; token ID is
the channel ID evolved.  The first-party concept is interesting and
potentially valuable, assuming the other issues aren't resolved.  The
list also only surveyed work that has been submitted to the IETF; the
macaroon concept is another point of interest in the space.

I have reservations about defining a mechanism that fails open without
any way of learning that this has happened.  Mike and I discussed some
amendments that might work.

Given the narrow locus of effort in this area, I think that a new,
short-lived working group is the best way to deal with this.  Building
something (anything) that helps with this cookie mess would be great.

---

From: Mike West <[email-masked]>
Date: Sat, 22 Nov 2014 10:31:34 +0100

Thanks to all three of you!

On Fri, Nov 21, 2014 at 9:49 PM, Yoav Nir <[email-masked]> wrote:

> This mailing list is for discussing current work items for httpbis:
> HTTP/2, Alt-Svc, etc.  A little discussion of related “homeless” topics is
> usually tolerated as long as there is a small amount of traffic that does
> not distract people from the on-topic discussions.
>

I certainly don't want to disrupt work on HTTP. However, WebSec seemed both
quiet, and focused on finishing HSTS/PKP. Those seemed less conducive to
cookie discussions than HTTP, but I'm certainly happy to take the
conversation there if it's the right thing to do.

> Your proposal (and Andrei’s) have one important thing that the authors of
> proposals in the previous round didn’t: the people behind them (you and
> Andrei) actually work on browsers, so your proposals might get implemented.
> That’s a good start.
>

The proposals I'm advocating are also trivial; they don't introduce any new
concepts to the platform, they merely apply concepts we already have to
cookies in slightly new ways. This is true both in terms of the user
agent's implementation as well as website adoption.

If putting together a prototype would help move things along, I'm happy to
do so in Chromium.

> So, for starters it’s OK to start the discussion here. ... When (and if)
> things seem to be converging (on a list of requirements and 1 or more
> proposals) then we can have the discussion again about what working group
> should handle this: httpbis, uta or a new working group.
>

Thanks, this seems like very reasonable advice!

> But start with showing that there is interest.

I've talked with folks at Mozilla who seemed interested in both proposals.
Indeed, "first-party cookies" is, in many ways, an adaptation of Mark
Goodwin's "samedomain cookies" proposal:
http://people.mozilla.org/~mgoodwin/SameDomain/samedomain-latest.txt. I
suspect he'd be interested in implementing something in Gecko. (+mgoodwin

On Sat, Nov 22, 2014 at 1:38 AM, Martin Thomson <[email-masked]>
wrote:
>
> The first-party concept is interesting and
> potentially valuable, assuming the other issues aren't resolved.

Which other issues? Naively, it seems useful in and of itself.

> The list also only surveyed work that has been submitted to the IETF; the

It's also significantly more complex than these proposals. :)

> amendments that might work.

There's certainly more discussion to be had on this topic in particular,
and I do appreciate your input so far. Since there seems to be at least
vague interest on this list, I'll hop back to that other thread to pick
things up again.

> something (anything) that helps with this cookie mess would be great.

I'm a little worried that spinning up a working group will run counter to
these proposal's simplicity. Perhaps this is my lack of IETF experience
talking, but I've certainly seen problems grow to fill the space allotted
to them in other areas. If we spin up a working group, I'm worried we'd get
lost in (useful!) discussions about what we should have _instead_ of
cookies, rather than how we could implement something which serves the uses
cases these two proposals highlight.

But if tightly scoped WGs work well in this forum, then I'm all for it!

-mike

---

From: Yoav Nir <[email-masked]>
Date: Tue, 25 Nov 2014 00:47:03 +0200

Hi, Mike

I believe you are underestimating the abilities of a working group to pick and bike-shed. Your proposal may look straightforward to you, but by the time everyone’s had their say, a lot will have been said.

When we tried to make a “what’s wrong with cookies” list in WebSec, we had a really long list, because different people had different things that bothered them: the bearer token nature of them, the scoping, the irrevocability, the fact that it gets transmitted again and again.

Another issue that makes this a risky proposition to any (existing or new) working group is that there are multiple proposals out there. This very working group spent quite a few months picking among different proposals for a starting point for HTTP/2, even though SPDY was there first and had an implementation in the field. Having a prototype is a good thing in that it helps ADs and participants know that a specification has a decent chance of getting deployed. Interest from browser vendors also goes a long way towards that goal. 

For now, there has been a weak response to your message. There are some people who are not following httpbis closely who might also be interested. To make this a work item (for this or a new WG) we’d have to show several things:
 - A clearly defined problem (no need for a draft)
 - A clear and concise set of requirements (this is where people might come up with their own pet requirements)
 - Interest from potential implementers (I think we got that)
 - A direction for a solution (hopefully with at least a rough consensus that this is the correct direction)
 - People willing to edit a document for the working group (you?)
 - People willing to review. There is nothing so frustrating as a WG session where the chair asks “who has read the document” and only the document authors raise their hands.

So assuming we can get at least the first 4 of these, then there’s something to talk about with our AD.

Yoav

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 25 Nov 2014 10:33:46 +1100

Hey Mike,

Sorry, I thought I responded to this a few days ago, but apparently not.

I encouraged people at the HNL meeting to read these and comment as well. Now is a good time to consider adopting these, since http/2 is winding down. 

The hallway conversations I had about these seemed to be positive. I want to talk to a few more people (including Barry) about them, but adopting them is in-scope for our charter, and I think reasonable.

What I'd suggest is that you continue to work on them, do a prototype in Chrome, and discuss with other potential implementers -- using this mailing list to coordinate, discuss the drafts, etc. Once you get some more momentum on them, we can do a call for adoption and/or discuss other options.

Make sense?

Cheers,

> On 22 Nov 2014, at 8:31 pm, Mike West <[email-masked]> wrote:
> 
> I certainly don't want to disrupt work on HTTP. However, WebSec seemed both quiet, and focused on finishing HSTS/PKP. Those seemed less conducive to cookie discussions than HTTP, but I'm certainly happy to take the conversation there if it's the right thing to do.
>  
> The proposals I'm advocating are also trivial; they don't introduce any new concepts to the platform, they merely apply concepts we already have to cookies in slightly new ways. This is true both in terms of the user agent's implementation as well as website adoption.
> 
> If putting together a prototype would help move things along, I'm happy to do so in Chromium.
>  
>> So, for starters it’s OK to start the discussion here. ... When (and if) things seem to be converging (on a list of requirements and 1 or more proposals) then we can have the discussion again about what working group should handle this: httpbis, uta or a new working group.
> 
> I've talked with folks at Mozilla who seemed interested in both proposals. Indeed, "first-party cookies" is, in many ways, an adaptation of Mark Goodwin's "samedomain cookies" proposal: http://people.mozilla.org/~mgoodwin/SameDomain/samedomain-latest.txt. I suspect he'd be interested in implementing something in Gecko. (+mgoodwin
> 
> On Sat, Nov 22, 2014 at 1:38 AM, Martin Thomson <[email-masked]> wrote:
> There's certainly more discussion to be had on this topic in particular, and I do appreciate your input so far. Since there seems to be at least vague interest on this list, I'll hop back to that other thread to pick things up again.
>  
> I'm a little worried that spinning up a working group will run counter to these proposal's simplicity. Perhaps this is my lack of IETF experience talking, but I've certainly seen problems grow to fill the space allotted to them in other areas. If we spin up a working group, I'm worried we'd get lost in (useful!) discussions about what we should have _instead_ of cookies, rather than how we could implement something which serves the uses cases these two proposals highlight.
> 

--
Mark Nottingham   https://www.mnot.net/