Subject: [httpwg/http-extensions] rfc6265bis - Same-Site cookies - clarify "site for cookies" in the case of redirects (#593)

From: HTTP issue updates <[email-masked]>
Date: Wed, 25 Apr 2018 08:29:35 -0700

Following a conversation the other day, I think we need to clarify what the "site for cookies" in the case of redirects.

The relevant section of the specification reads:

> If "request"'s client is "null", return "same-site".
> 
>        Note that this is the case for navigation triggered by the user
>        directly (e.g. by typing directly into a user agent's address
>        bar).

I take this to mean that for the *first* request (the request that the user initiated) the client is null and, therefore, same-site - but for subsequent requests, since they're initiated by the redirect, they may be treated as cross-site requests (if 'target' differs from 'site').

This differs from the Chrome implementation's current behavior. I think, for strict same site cookies at least, this perhaps needs tightening up.

Thoughts?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/593