Subject: Call for Adoption: Same-site Cookies

From: Mark Nottingham <[email-masked]>
Date: Wed, 4 May 2016 17:17:19 +1000

<https://tools.ietf.org/html/draft-west-first-party-cookie>

We discussed this draft in Buenos Aires, and it appears that there's a growing amount of implementer interest in it.

As discussed earlier <http://www.w3.org/mid/[email-masked]>, we are going to use a Call for Adoption process to assure that what we specify in terms of changes to Cookies -- if anything -- will actually get implemented.

So, please discuss on-list:

1) Your intent to implement it (or lack thereof). 
2) Your support for the spec (or lack thereof).

Regards,

--
Mark Nottingham   https://www.mnot.net/

---

From: Mike West <[email-masked]>
Date: Wed, 4 May 2016 09:49:26 +0200

> 1) Your intent to implement it (or lack thereof).

Chrome is shipping the -07 draft to our beta channel right now, and we
anticipate it hitting stable in Chrome ~51.

> 2) Your support for the spec (or lack thereof).

Unsurprisingly, Chrome supports adopting the spec. :)

-mike

---

From: Martin Thomson <[email-masked]>
Date: Thu, 5 May 2016 00:24:44 +1000

> 1) Your intent to implement it (or lack thereof).

I'll let others at Mozilla comment, but I believe that we are doing this.

> 2) Your support for the spec (or lack thereof).

I want to see it published.  My only reservation is the further slide
into cookie-madness.  Cookies never played by origin, but we're making
it worse and worse and worse.

---

From: Daniel Veditz <[email-masked]>
Date: Thu, 5 May 2016 08:11:52 -0700

> > 1) Your intent to implement it (or lack thereof).

​We are currently working on supporting same-site cookies, targeting
Firefox 50​
​.
​

> > 2) Your support for the spec (or lack thereof).

Mozilla supports this feature.
​

> My only reservation is the further slide
> ​ ​
> ​ ​

​How so? Cookies are already madness; the recent proposals have been
attempts to give sites a way to opt-in to safer behaviors without forcing
everything to upgrade at once.

-
​Dan Veditz​

---

From: Mark Nottingham <[email-masked]>
Date: Thu, 26 May 2016 14:42:22 +1000

OK, we've seen support from implementers on this, and no pushback, so let's adopt it.

Mike, do you want to put the source in our repo? Happy to help if you like.

Cheers,

> On 4 May 2016, at 5:17 PM, Mark Nottingham <[email-masked]> wrote:
>

---

From: Mike West <[email-masked]>
Date: Mon, 30 May 2016 16:27:05 +0200

> OK, we've seen support from implementers on this, and no pushback, so

Great!

> Mike, do you want to put the source in our repo? Happy to help if you like.

I can take care of that tomorrow.

Silly process question: There are ~2 pending edits for nits in the -07
version. Should I incorporate those into the httpbis -00? Or should I
publish an -08 and copy that directly to the new -00?

-mike

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 31 May 2016 11:22:00 +1000

If they're purely editorial, go ahead and incorporate them. Otherwise, get the -00 in and we'll go from there.

Cheers,

> On 31 May 2016, at 12:27 AM, Mike West <[email-masked]> wrote:
> 
> Silly process question: There are ~2 pending edits for nits in the -07 version. Should I incorporate those into the httpbis -00? Or should I publish an -08 and copy that directly to the new -00?
> 
> -mike