Subject: [httpwg/http-extensions] [6265bis] Add double-keying policy example to "Third-party cookies" section (#248)

From: HTTP issue updates <[email-masked]>
Date: Tue, 11 Oct 2016 22:41:55 -0700

Firefox and Tor Browser are introducing an [option](https://www.torproject.org/projects/torbrowser/design/#idp55056352) to "double-key" cookies by (origin-domain|first-party-domain). (The first-party domain is defined as domain of the top-level document, visible to the user as the domain in the URL bar at the top of the browser.)

With double keying, it is possible for third-party cookies to be stored and retrieved, these third-party cookies cannot be used for tracking across websites.

I think this policy is notable in that it keeps third-party cookies enabled but also prevents tracking. Thus third-party cookies function properly for many use cases. I would like to suggest adding this policy to the discussion of examples in RFC6265 section 7.1, "Third-party cookies." After the sentence, 

> Others refuse to process the Set-Cookie header in responses to third-party requests.

it might be of helpful to add something like

> Still others store third-party cookies loaded by different first-party domains into separate cookie databases, to prevent cross-site tracking.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/248