Subject: Call for Adoption: Cookie Incrementalism

From: Mark Nottingham <[email-masked]>
Date: Fri, 13 Nov 2020 10:45:29 +1100

Those with good memories will recall that when we started RFC6265bis, we required significant changes to the specification to be backed by a separate I-D, so that we could judge consensus and implementation support for it separately. See:
  https://lists.w3.org/Archives/Public/ietf-http-wg/2015OctDec/0165.html

In the spirit of that, we have one more proposal for consideration:
  https://tools.ietf.org/html/draft-west-cookie-incrementalism-01

Parts of this were discussed at the recent interim:
  https://httpwg.org/wg-materials/interim-20-10/rfc6265bis.pdf#page=3

Other parts (e.g., s 3.4-3.6) may need more discussion; if we adopt the draft, we may decide that they aren't worth pursuing, but by default we'd spend some time discussing them.

Please comment on whether you support adoption of this document into RFC6265bis. In particular, we're looking for implementer feedback because -- as before -- our goal for this effort is to be closely aligned with implementation behaviour. 

The Call for Adoption will run until 27 November.

- Mark and Tommy

---

From: Brad Lassey <[email-masked]>
Date: Thu, 12 Nov 2020 19:01:57 -0500

I support adoption

On Thu, Nov 12, 2020 at 6:49 PM Mark Nottingham <[email-masked]> wrote:

> Those with good memories will recall that when we started RFC6265bis, we
> required significant changes to the specification to be backed by a
> separate I-D, so that we could judge consensus and implementation support
> for it separately. See:
> Other parts (e.g., s 3.4-3.6) may need more discussion; if we adopt the
> draft, we may decide that they aren't worth pursuing, but by default we'd
> spend some time discussing them.
>
> Please comment on whether you support adoption of this document into
> RFC6265bis. In particular, we're looking for implementer feedback because
> -- as before -- our goal for this effort is to be closely aligned with
> implementation behaviour.
>

---

From: Ian Swett <[email-masked]>
Date: Thu, 12 Nov 2020 19:08:14 -0500

I also support adoption.

---

From: "Martin Thomson" <[email-masked]>
Date: Fri, 13 Nov 2020 14:00:25 +1100

>   https://tools.ietf.org/html/draft-west-cookie-incrementalism-01
...
> draft, we may decide that they aren't worth pursuing, but by default 
> we'd spend some time discussing them.

Happy to adopt this.  As noted in discussions, Mozilla is shipping some of these.  I don't have firm answers on all of the pieces, but we can discuss them further.

---

From: Willy Tarreau <[email-masked]>
Date: Fri, 13 Nov 2020 06:23:28 +0100

>   https://tools.ietf.org/html/draft-west-cookie-incrementalism-01

Yes, I remember some of these points being discussed a while ago and I
do support adoption as well.

I also remember one idea that started being discussed along the points in
this document which was to encourage browsers to delay posting very large
(or numerous) cookies to slow down browsing on sites which abuse them.
Having, say, half a second delay per kB would not hurt a login page
requiring a full user context and a large cookie once, but would hurt
sites using them on each and every page.

Regards,
Willy

---

From: Daniel Stenberg <[email-masked]>
Date: Fri, 13 Nov 2020 08:26:14 +0100 (CET)

> RFC6265bis.

I support adoption.

-- 

  / daniel.haxx.se

---

From: Amos Jeffries <[email-masked]>
Date: Fri, 13 Nov 2020 20:47:07 +1300

I support adoption.

Amos

---

From: Lily Chen <[email-masked]>
Date: Fri, 13 Nov 2020 10:50:07 -0500

I support adoption.

---

From: David Benjamin <[email-masked]>
Date: Fri, 13 Nov 2020 10:59:28 -0500

I support adoption.

On Fri, Nov 13, 2020 at 10:54 AM Lily Chen <[email-masked]> wrote:

>> > Those with good memories will recall that when we started RFC6265bis,
>> we required significant changes to the specification to be backed by a

---

From: Mike Taylor <[email-masked]>
Date: Fri, 13 Nov 2020 09:50:52 -0600

I support adoption.

thanks,
Mike

---

From: John Wilander <[email-masked]>
Date: Fri, 20 Nov 2020 15:41:34 -0800

I support adoption. However, I’d like to share some thoughts.

A lot of these incremental enhancements are for a web browser where a site, the Public Suffix List, a browsing context, the user agent, and a browsing session all make sense. Apple’s implementation of cookies is in a separate HTTP networking layer. Libcurl and libsoup are similar in my mind. When such a layer is used for web browsing, the proposed incremental enhancements make sense but they don’t always in other contexts. I don’t know the best way to make that clear. Maybe it’s obvious and we won’t have any problems but take the new proposed definition of session lifetime. It’s tied to “top-level browsing context” and “same-site documents.” That doesn’t make sense for a non-browser application using HTTP and cookies.

I’m sure we can work this out as the integration into the spec takes place.

   Regards, John

> On Nov 13, 2020, at 7:50 AM, Mike Taylor <[email-masked]> wrote:
>