Subject: Re: [http-state] HttpOnly

From: Adam Barth <[email-masked]>
Date: Tue, 1 Sep 2009 21:30:02 -0500

I've uploaded a new version of the draft that contains the concepts below:

http://www.ietf.org/id/draft-abarth-cookie-03.txt

Other than that, there aren't very many changes since the -02 version.

Adam

On Mon, Aug 31, 2009 at 6:28 AM, Adam Barth<[email-masked]> wrote:
> On Mon, Aug 31, 2009 at 2:17 AM, Ian Hickson<[email-masked]> wrote:
>> On Tue, 25 Aug 2009, Adam Barth wrote:
>>>
>>> On Tue, Aug 25, 2009 at 12:42 AM, Anne van Kesteren<[email-masked]> wrote:
>>> > I actually think it would be best if this specification defined a hook
>>> > for specifications that allow mutating cookies to hook into. They can
>>> > then decide on a per-API basis whether the flag needs to be taken into
>>> > account. Review will make sure that draft does the correct thing.
>>>
>>> Done.  If you define a "non-HTTP" API, then you'll get the HttpOnly
>>> restrictions.  If you think of a better name, let me know.
>>
>> I was reading:
>>
>>   http://tools.ietf.org/html/draft-abarth-cookie-02
>>
>> ...but couldn't find the relevant bit.
>
> I haven't updated the I-D since I added the relevant text.  I'll do
> that later in the week.  You can read the current version here:
>
> http://github.com/abarth/http-state/blob/f3f565011858d206ff8531eb05b11503db59ac59/drafts/cookie.xml
>
>> How should HTML5 be modified here:
>>
>>   http://www.whatwg.org/specs/web-apps/current-work/#dom-document-cookie
>>
>> ...to be compatible with what you are specifying?
>
> On getting, you want to return the cookie-string for the document's
> address for a "non-HTTP" API.  (If you can think of a better term than
> non-HTTP, please let me know.)
>
> On setting, you want to say that the user agent receives a
> set-cookie-string for the document's address via a "non-HTTP" API.
> The concept of a "set-cookie-string" isn't quite in the spec yet, but
> I'll add it in the next day or two.
>
> Adam
>

---

From: Ian Hickson <[email-masked]>
Date: Thu, 3 Sep 2009 12:15:13 +0000 (UTC)

On Mon, 31 Aug 2009, Adam Barth wrote:
> set-cookie-string for the document's address via a "non-HTTP" API. The 
> concept of a "set-cookie-string" isn't quite in the spec yet, but I'll 
> add it in the next day or two.

Done. Thanks.

-- 
Ian Hickson               U+1047E                )\._.,--....,'``.    fL
http://ln.hixie.ch/       U+263A                /,   _.. \   _\  ;`._ ,.
Things that are impossible just take longer.   `._.-(,_..'--(,_..'`-.;.'