[http-state] One last attempt to get y'all to like the idea of a non-inclusive Set-Cookie design

Paul James Hammant <phammant@thoughtworks.com> Thu, 18 November 2010 19:59 UTC

MIME-Version: 1.0
From: Paul James Hammant <phammant@thoughtworks.com>
Date: Thu, 18 Nov 2010 13:54:24 -0600
Message-ID: <AANLkTinfDu8SEJC8yd+q8dCOMOROpsBtOcgos4kTs=y3@mail.gmail.com>
To: http-state <http-state@ietf.org>
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: quoted-printable
Subject: [http-state] One last attempt to get y'all to like the idea of a non-inclusive Set-Cookie design
Precedence: list

Refer - http://paulhammant.com/blog/not-path-cookies.html

It is a modification to my proposal last month; Better this time based
on the comments in this mail list when I last proposed it. I also
reference the Michal Zalewski blog posting critical of cookies

I think it is even more relevant given the
http://www.eff.org/pages/how-deploy-https-correctly posting from three
days ago where the EFF suggests no more mixed content (see below).

-Paul

>From the EFF blog entry:

** Mixed Content **

When hosting an application over HTTPS, there can be no mixed content;
that is, all content in the page must be fetched via HTTPS. It is
common to see partial HTTPS support on sites, in which the main pages
are fetched via HTTPS but some or all of the media elements,
stylesheets, and JavaScript in the page are fetched via HTTP.

This is unsafe because although the main page load is protected
against active and passive network attack, none of the other resources
are. If a page loads some JavaScript or CSS code via HTTP, an attacker
can provide a false, malicious code file and take over the page’s DOM
once it loads. Then, the user would be back to a situation of having
no security. This is why all mainstream browsers warn users about
pages that load mixed content. Nor is it safe to reference images via
HTTP: What if the attacker swapped the Save Message and Delete Message
icons in a webmail app?

You must serve the entire application domain over HTTPS. Redirect HTTP
requests with HTTP 301 or 302 responses to the equivalent HTTPS
resource.

Some site operators provide only the login page over HTTPS, on the
theory that only the user’s password is sensitive. These sites’ users
are vulnerable to passive and active attack.

[http-state] One last attempt to get y'all to lik… Paul James Hammant
Re: [http-state] One last attempt to get y'all to… Mark Pauley
Re: [http-state] One last attempt to get y'all to… Paul James Hammant
Re: [http-state] One last attempt to get y'all to… Mark Pauley