Subject: [httpwg/http-extensions] Clarify handling of invalid SameSite values (fixes #389) (#574)

From: HTTP issue updates <[email-masked]>
Date: Mon, 09 Apr 2018 18:59:41 +0000 (UTC)

There is currently a discrepancy in the spec regarding invalid values
in the SameSite cookie attribute.

For example, this cookie:

  Set-Cookie: foo=bar; SameSite=bogus

is expected to be dropped entirely according to the "Server Requirements"
under Section 4.1.2.7:

  If the "SameSite" attribute's value is neither of these [ "Lax",
  "Strict" ], the cookie will be ignored.

whereas under Section 5.3.7 of "User Agent Requirements", the cookie
is to be kept but the attribute is ignored:

  If cookie-av's attribute-value is not a case-insensitive match for
  "Strict" or "Lax", ignore the "cookie-av".

Additionally, the end of Section 4.1.2 also matches the behavior
described in Section 5.3.7:

  User agents ignore unrecognized cookie attributes (but not the entire
  cookie).

>From a forward-compatibility point of view, the behavior described in
section 5.3.7 is the ideal one since it allows for future expansion
of this feature such as:

  Set-Cookie: foo=bar; SameSite=medium
You can view, comment on, or merge this pull request online at:

  https://github.com/httpwg/http-extensions/pull/574

-- Commit Summary --

  * Clarify handling of invalid SameSite values (fixes #389)

-- File Changes --

    M draft-ietf-httpbis-rfc6265bis.md (2)

-- Patch Links --

https://github.com/httpwg/http-extensions/pull/574.patch
https://github.com/httpwg/http-extensions/pull/574.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/pull/574