Subject: [v6ops] FW: New Version Notification for draft-vyncke-v6ops-happy-eyeballs-cookie-01.txt

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Fri, 6 Mar 2015 13:52:20 +0000

As discussed earlier, here is a -01 version adding numerous comments to be
accurate and making it more generic (hence changing the title but not the
filename).

Not sure whether it should be a WG document though.

Comments are welcome of course

-éric

On 6/03/15 08:59, "[email-masked]" <[email-masked]>
wrote:

>
>A new version of I-D, draft-vyncke-v6ops-happy-eyeballs-cookie-01.txt
>has been successfully submitted by Eric Vyncke and posted to the
>IETF repository.
>
>Name:		draft-vyncke-v6ops-happy-eyeballs-cookie
>Revision:	01
>Title:		HTTP State Management Mechanisms with Multiple Addresses User
>Agents
>Document date:	2015-03-06
>Group:		Individual Submission
>Pages:		7
>URL:            
>http://www.ietf.org/internet-drafts/draft-vyncke-v6ops-happy-eyeballs-cook
>ie-01.txt
>Status:         
>https://datatracker.ietf.org/doc/draft-vyncke-v6ops-happy-eyeballs-cookie/
>Htmlized:       
>http://tools.ietf.org/html/draft-vyncke-v6ops-happy-eyeballs-cookie-01
>Diff:           
>http://www.ietf.org/rfcdiff?url2=draft-vyncke-v6ops-happy-eyeballs-cookie-
>01
>
>Abstract:
>   HTTP servers usually save session states in their persistent storage
>   indexed by session cookies generated by the HTTP servers.  It is up
>   to the HTTP user-agent to send this session cookie on each HTTP
>   request.  Some HTTP servers check whether the cookie is associated
>   with the HTTP user-agent by the means of the user-agent IP address.
>   Everything linking a state to an IP address (such as OAuth access
>   code) to an IP address has the same issue.
>
>   If the Happy Eyeball mechanism is used to select between IPv6 and
>   IPv4, it may happen that while using the same HTTP server, some HTTP
>   requests are done over IPv6 and the others over IPv4, which leads to
>   two different sets of session states in the HTTP server.  This has
>   the consequence of inconsistencies at the HTTP server.
>
>   The only purpose of this document is to document this issue in more
>   details than in section 8.2 of RFC 6883 including security
>   considerations and mitigations.
>
>   A similar problem arises with the use of non RFC 6888 compliant
>   Carrier-Grade NAT (CGN) devices used to access an IPv4-only HTTP
>   server or HTTP user-agent using multi-homing.
>
>                  
>        
>
>
>Please note that it may take a couple of minutes from the time of
>submission
>until the htmlized version and diff are available at tools.ietf.org.
>
>The IETF Secretariat
>