Subject: [http-state] Closing Ticket 6: host-only cookies

From: Adam Barth <[email-masked]>
Date: Fri, 12 Feb 2010 23:55:12 -0800

Discussion about Ticket 6 seems to have quieted down.

== Summary of Discussion ==

Daniel Stenberg argued that we'll be stuck with IE's behavior for a
while, so we should spec that implementing host-only is optional.

Maciej Stachowiak suggested that we not assume Microsoft won't
implement host-only without actually hearing it from them.  (Note:
Microsoft neither committed to implementing host-only nor refused to
implement it.)

Dan Winship suggested that we should require user agents implement
host-only cookies but that we should warn servers that some legacy
user agents don't.

Roy T. Fielding argued that the security benefits of host-only trumped
IE not implementing host-only.

Blake Frantz supported Dan Winship.

== Resolution ==

I've changed the spec as suggested by Dan Winship and supported by Roy
T. Fielding and Blake Frantz.  To wit:

1) User agents are required to implement host-only cookies (matching
the behavior of Firefox, Chrome, Safari, and Opera).

2) The spec warns the reader that some legacy user agents (in this
case IE) do not implement host-only cookies.

I've pushed a new version of the draft with these changes:

http://www.ietf.org/id/draft-ietf-httpstate-cookie-03.txt

We can re-open the issue if someone presents material new information.

Adam

---

From: Daniel Stenberg <[email-masked]>
Date: Sat, 13 Feb 2010 13:20:06 +0100 (CET)

On Fri, 12 Feb 2010, Adam Barth wrote:

> 1) User agents are required to implement host-only cookies (matching the 
> behavior of Firefox, Chrome, Safari, and Opera).
>
> 2) The spec warns the reader that some legacy user agents (in this case IE) 
> do not implement host-only cookies.

For the record: I think this is a great compromise given the situation.

-- 

  / daniel.haxx.se