Subject: I-D Action: draft-ietf-httpbis-rfc6265bis-01.txt

From: [email-masked]
Date: Tue, 25 Apr 2017 02:54:48 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Hypertext Transfer Protocol of the IETF.

        Title           : HTTP State Management Mechanism
        Authors         : Adam Barth
                          Mike West
	Filename        : draft-ietf-httpbis-rfc6265bis-01.txt
	Pages           : 40
	Date            : 2017-04-25

Abstract:
   This document defines the HTTP Cookie and Set-Cookie header fields.
   These header fields can be used by HTTP servers to store state
   (called cookies) at HTTP user agents, letting the servers maintain a
   stateful session over the mostly stateless HTTP protocol.  Although
   cookies have many historical infelicities that degrade their security
   and privacy, the Cookie and Set-Cookie header fields are widely used
   on the Internet.  This document obsoletes RFC 2965.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-httpbis-rfc6265bis/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-01
https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-01

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-httpbis-rfc6265bis-01

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Mike West <[email-masked]>
Date: Tue, 25 Apr 2017 13:03:55 +0200

Following up on the discussion at the last meeting, I've revived the
RFC6265bis draft, pulling in both
https://tools.ietf.org/html/draft-ietf-httpbis-cookie-alone-01 and
https://tools.ietf.org/html/draft-ietf-httpbis-cookie-prefixes-00.

https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site-00 is going
to take a little bit longer, as I think some pieces of it really need to
live in Fetch as opposed to the RFC. I'll work on that separation, and try
to address the remaining issues
<https://github.com/httpwg/http-extensions/issues?q=is%3Aissue+is%3Aopen+label%3A6265bis>
before the next meeting in July so that we have something concrete to
discuss in that venue.

In any event, now's a good time to file bugs, if you're so inclined. :)

-mike

---

From: Mike West <[email-masked]>
Date: Tue, 25 Apr 2017 13:04:36 +0200

(Dropping announcement lists, sorry for the noise. :( )

-mike

On Tue, Apr 25, 2017 at 1:03 PM, Mike West <[email-masked]> wrote:

> RFC6265bis draft, pulling in both https://tools.ietf.org/
> html/draft-ietf-httpbis-cookie-alone-01 and https://tools.ietf.org/
> html/draft-ietf-httpbis-cookie-prefixes-00.
>
> https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site-00 is
> going to take a little bit longer, as I think some pieces of it really need
> to live in Fetch as opposed to the RFC. I'll work on that separation, and
> try to address the remaining issues

---

From: Kari Hurtta <[email-masked]>
Date: Tue, 25 Apr 2017 20:29:33 +0300 (EEST)

HTTP State Management Mechanism
https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-01

4.1.3.1.  The "__Secure-" Prefix
https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-01#section-4.1.3.1

|   Whereas the following "Set-Cookie" header would be accepted:
|
|   Set-Cookie: __Secure-SID=12345; Domain=example.com; Secure

=> 

|   While the would be accepted if set from a secure origin (e.g.
|   "https://example.com/"), and rejected otherwise:
|
|   Set-Cookie: __Secure-SID=12345; Domain=example.com; Secure

Sama than on   4.1.3.2.  The "__Host-" Prefix

There is on

5.3.  Storage Model
https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-01#section-5.3

|   9.   If the scheme component of the request-uri does not denote a
|        "secure" protocol (as defined by the user agent), and the
|        cookie's secure-only-flag is true, then abort these steps and
|        ignore the cookie entirely.

/ Kari Hurtta