Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Introduce "Schemeful Same-Site" cookies. #1324

Merged
merged 5 commits into from
Dec 7, 2020
Merged

Introduce "Schemeful Same-Site" cookies. #1324

merged 5 commits into from
Dec 7, 2020

Conversation

miketaylr
Copy link
Collaborator

@miketaylr miketaylr commented Oct 28, 2020 •
edited
Loading

Opening for discussion, per the last interim group meeting.

This should correspond to https://tools.ietf.org/html/draft-west-cookie-incrementalism-01#section-3.3

@mikewest mikewest added 6265bis 6265bis samesite RFC6265bis's `SameSite` cookie attribute. labels Oct 28, 2020
@miketaylr
Copy link
Collaborator Author

Can you please review, @chlily1?

mikewest
mikewest reviewed Nov 25, 2020
View reviewed changes
Copy link
Member

@mikewest mikewest left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A few small comments. Also, please add a changelog entry.

draft-ietf-httpbis-rfc6265bis.md Outdated

For a given request ("request"), the following algorithm returns `same-site` or
`cross-site`:
1. If A and B are both scheme/host/port triples:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we use the same "tuple origin" terminology as HTML here?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi Mike,
Has there been any changes on the IETF/WHATWG term differences? This same point came up during the PR into cookie inc. mikewest/cookie-incrementalism#3 (comment)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ha! Ok. I still agree with myself from earlier in the year. :)

Ping @mnot @tfpauly. What would y'all like the working group's policy to be vis a vis these terms? I'd like for us to end up using the same terms with the same definition regardless of venue.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ping @mnot and @tfpauly for the conversation here and below ("URL", etc).

@miketaylr
Copy link
Collaborator Author

Thanks for the review comments! I'm going to let this bake for a few days (and let some folks respond), and eat a lot of pumpkin pie in the meantime. Looking to pick it up early next week.

@mikewest
Copy link
Member

mikewest commented Dec 2, 2020

I'd suggest that we try to get this landed, and then spin off a new -07. WDYT?

@miketaylr
Copy link
Collaborator Author

miketaylr commented Dec 2, 2020 •
edited
Loading

I'd suggest that we try to get this landed, and then spin off a new -07. WDYT?

SGTM! My goal is to address feedback before EOW (and I'll file a new follow-up issue to hash out origin vs tuple and we can make changes the next go around):

filed #1337

@miketaylr
Copy link
Collaborator Author

PTAL @mikewest @chlily1

(I'm punting on the "origin tuple" rec -- I filed #1337 for folks to align on that)

@chlily1
Copy link
Contributor

chlily1 commented Dec 4, 2020

PTAL @mikewest @chlily1

LGTM! Thanks!

sbingler
sbingler requested changes Dec 4, 2020
View reviewed changes
Copy link
Collaborator

@sbingler sbingler left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can't seem to comment on the line but 654 isn't correct any longer.

@miketaylr
Copy link
Collaborator Author

I can't seem to comment on the line but 654 isn't correct any longer.

Great catch, let me fix that up.

@mikewest
Copy link
Member

mikewest commented Dec 7, 2020

Thanks for punting the terminology conversation out to a separate bug. LGTM2; I'll land this and spin out an -07 draft.

@mikewest mikewest merged commit 3767800 into httpwg:master Dec 7, 2020
@miketaylr
Copy link
Collaborator Author

Thanks all!

@miketaylr miketaylr deleted the schemeful-samesite branch December 7, 2020 16:33
@chlily1 chlily1 mentioned this pull request Feb 4, 2021
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mikewest mikewest mikewest left review comments

@reschke reschke reschke left review comments

@chlily1 chlily1 chlily1 left review comments

@sbingler sbingler sbingler requested changes

Assignees
No one assigned
Labels
6265bis samesite RFC6265bis's `SameSite` cookie attribute. 6265bis
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@miketaylr @mikewest @chlily1 @reschke @sbingler