Subject: Re: [httpwg/http-extensions] [6265bis] Add double-keying policy example to "Third-party cookies" section (#248)

From: HTTP issue updates <[email-masked]>
Date: Tue, 22 Nov 2016 05:51:44 -0800

It would be useful to have an attribute in the Set-Cookie header so origins can specify double keying if the user agent supports it.

Set-Cookie: {name}={value};doubleKeyed;hhpOnly etc....

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/248#issuecomment-262245328

---

From: HTTP issue updates <[email-masked]>
Date: Tue, 22 Nov 2016 05:54:01 -0800

Woops

Set-Cookie: {name}={value};doubleKeyed;httpOnly;secure etc....

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/248#issuecomment-262245876

---

From: HTTP issue updates <[email-masked]>
Date: Tue, 22 Nov 2016 18:21:08 -0800

Isn't that effectively what SameSite is?

http://httpwg.org/http-extensions/draft-ietf-httpbis-cookie-same-site.html

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/248#issuecomment-262421206

---

From: HTTP issue updates <[email-masked]>
Date: Thu, 24 Nov 2016 11:36:07 -0800

Actually, after thinking about it, it's not the same. 

The SameSite attribute says only send this cookie in a request when it is same origin as the top-level browsing context - effectively the server is asking for a "third-party cookie block" for this cookie.

I was thinking of the doubleKeyed cookie idea where there is a separate cookie store for the parent contexts, which would allow a lot of functionality but mitigate cross-origin tracking. If this supported as a user option in the UA why not extend it as a server option also allowing sites to help protect user's privacy.

Maybe there is a halfway house where you could constrain sending back cookies to same context i.e. the chain of descendent origins is the same as when the cookie was stored 

toplevel.com->widgit.com->cookiedwidgit.com
is not "same context" as
other-toplevel.com->cookiedwidgit.com etc.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/248#issuecomment-262836047