Subject: RFC6265 - Difference between RFC and implementation with regards to host-only-flag

From: Matthew Cox <[email-masked]>
Date: Fri, 3 Jun 2016 16:31:56 +0000

We noticed that the host-only-flag behavior is different in most browsers vs the RFC, and I'd like to get this updated with new work being done on the cookie RFC.

Given these two headers in a response from a request to http://contoso.com/:

Set-Cookie: mycookie=nothostonly; domain=contoso.com
Set-Cookie: mycookie=hostonly

You would expect one cookie based on RFC 6265 section 5.3 where the cookie is defined by the name, domain, and path.

However, most browsers will create two cookies since they take host-only-flag into account when looking up/creating a cookie.

Based on this I'd like to update section 5.3 and 4.1.2 to add host-only-flag to the list of properties that make a unique cookie in the store.

What's the best way to get this added?  Should I create an issue in GitHub?

Thanks,

Matthew

---

From: Mike West <[email-masked]>
Date: Tue, 21 Jun 2016 14:42:04 +0200

On Fri, Jun 3, 2016 at 6:31 PM, Matthew Cox <[email-masked]> wrote:

> We noticed that the host-only-flag behavior is different in most browsers
> vs the RFC, and I’d like to get this updated with new work being done on
> the cookie RFC.
>
>
>
> You would expect one cookie based on RFC 6265 section 5.3 where the cookie
> is defined by the name, domain, and path.
>
>
>
> However, most browsers will create two cookies since they take
> host-only-flag into account when looking up/creating a cookie.
>
>
>
> Based on this I’d like to update section 5.3 and 4.1.2 to add
> host-only-flag to the list of properties that make a unique cookie in the
> store.
>

This seems like a reasonable change to me, and I believe it matches
Chrome's existing behavior.

> What’s the best way to get this added?  Should I create an issue in GitHub?
>

I'd say file an issue against
https://github.com/httpwg/http-extensions/issues; not sure if this is a
substantial enough change to require more than that. Mark?

-mike

-mike

On Fri, Jun 3, 2016 at 6:31 PM, Matthew Cox <[email-masked]> wrote:

> We noticed that the host-only-flag behavior is different in most browsers
> vs the RFC, and I’d like to get this updated with new work being done on
> the cookie RFC.
>
>
>
> You would expect one cookie based on RFC 6265 section 5.3 where the cookie
> is defined by the name, domain, and path.
>
>
>
> However, most browsers will create two cookies since they take
> host-only-flag into account when looking up/creating a cookie.
>
>
>
> Based on this I’d like to update section 5.3 and 4.1.2 to add
> host-only-flag to the list of properties that make a unique cookie in the
> store.
>
>
>
> What’s the best way to get this added?  Should I create an issue in GitHub?
>
>
>
> Thanks,
>
>
>
> Matthew
>
>
>

---

From: Matthew Cox <[email-masked]>
Date: Tue, 21 Jun 2016 16:19:36 +0000

Thanks Mike!

I have already filed an issue: https://github.com/httpwg/http-extensions/issues/199.

Please let me know if something else needs to be done to get this updated.

Thanks,

Matthew

From: Mike West [mailto:[email-masked]]
Sent: Tuesday, June 21, 2016 5:42 AM
To: Matthew Cox <[email-masked]>; Mark Nottingham <[email-masked]>
Cc: [email-masked]
Subject: Re: RFC6265 - Difference between RFC and implementation with regards to host-only-flag

On Fri, Jun 3, 2016 at 6:31 PM, Matthew Cox <[email-masked]<mailto:[email-masked]>> wrote:

We noticed that the host-only-flag behavior is different in most browsers vs the RFC, and I’d like to get this updated with new work being done on the cookie RFC.

Set-Cookie: mycookie=nothostonly; domain=contoso.com<http://contoso.com>

Based on this I’d like to update section 5.3 and 4.1.2 to add host-only-flag to the list of properties that make a unique cookie in the store.

This seems like a reasonable change to me, and I believe it matches Chrome's existing behavior.

I'd say file an issue against https://github.com/httpwg/http-extensions/issues; not sure if this is a substantial enough change to require more than that. Mark?

-mike

-mike

On Fri, Jun 3, 2016 at 6:31 PM, Matthew Cox <[email-masked]<mailto:[email-masked]>> wrote:
We noticed that the host-only-flag behavior is different in most browsers vs the RFC, and I’d like to get this updated with new work being done on the cookie RFC.

Set-Cookie: mycookie=nothostonly; domain=contoso.com<http://contoso.com>
Set-Cookie: mycookie=hostonly

Based on this I’d like to update section 5.3 and 4.1.2 to add host-only-flag to the list of properties that make a unique cookie in the store.

Thanks,

Matthew

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 22 Jun 2016 16:36:15 +1000

I think we can treat this as the other specific issue found, and discuss it as part of the "core" draft, rather than requiring a seperate I-D.

Cheers,

> On 22 Jun 2016, at 2:19 AM, Matthew Cox <[email-masked]> wrote:
> 
> Thanks Mike!
>  

--
Mark Nottingham   https://www.mnot.net/