Subject: [httpwg/http-extensions] SameSite Cookie Attribute - Is attribute-value required? (#389)

From: HTTP issue updates <[email-masked]>
Date: Fri, 01 Sep 2017 09:40:47 -0700

https://bugs.chromium.org/p/chromium/issues/detail?id=635882

Section 3.1 of the spec states that "SameSite" alone (without an attribute value) is a valid token: https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site-00#section-3.1

Section 4.1 https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site-00#section-4.1 states 

   1.  If "cookie-av"'s "attribute-value" is not a case-insensitive
       match for "Strict" or "Lax", ignore the "cookie-av".

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/389

---

From: HTTP issue updates <[email-masked]>
Date: Thu, 07 Sep 2017 17:19:15 +0000 (UTC)

Ah.  https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site-00 draft is outdated vs. https://github.com/httpwg/http-extensions/edit/master/draft-ietf-httpbis-cookie-same-site.md. The latter no longer allows a bare "SameSite" token, and it calls for the cookie to be dropped in the event that the samesite-value isn't either "strict" or "lax".

However, I think this text isn't quite right:

  If `cookie-av`'s `attribute-value` is not a case-insensitive match for
    "Strict" or "Lax", ignore the `cookie-av`.

The `cookie-av` in this case is 'SameSite=whatever' and we want to ignore the whole cookie, not just the invalid attribute?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/389#issuecomment-327865650