Subject: Re: [httpwg/http-extensions] httpbis-cookie-alone breaks backwards compat (#223)

From: HTTP issue updates <[email-masked]>
Date: Wed, 17 Aug 2016 14:04:46 -0700

@mnot yeah, the order matching was what I had in mind.  I have mixed feelings on abbreviation though.  Part of P3P's challenges were due to it being cryptic.  Other specs like CSP are not abbreviating too much.  But DNT/TSV are.  Would it be better to assume widespread HTTP/2 adoption and count on header compression?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/223#issuecomment-240547908

---

From: HTTP issue updates <[email-masked]>
Date: Thu, 18 Aug 2016 01:27:01 -0700

SGTM. Who's taking it to the list?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/223#issuecomment-240657138

---

From: HTTP issue updates <[email-masked]>
Date: Fri, 19 Aug 2016 17:08:30 -0700

I too, have concerns about the non-exact path matching and the asymmetry of the results depending on the order in which differing-path cookies are set.

A similar concern about symmetry: why should secure sites get a free pass to downgrade a secure cookie to insecure? That's not "leaving secure cookies alone". Such an attempt might actually just be a site bug.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/223#issuecomment-241163996