Cookie layering - Http prefix - #3110
Merged
Merged
Conversation
Contributor
Author
|
Given https://lists.w3.org/Archives/Public/ietf-http-wg/2025AprJun/0188.html, maybe we want to land __HttpOnly first while we figure out what the compounding mechanism here should be? |
Contributor
|
It might be good to open an issue to discuss further, but my inclination would be that we turn this into some kind of table of prefix strings and their corresponding restrictions down the line. I don't think the combinatorial explosion is all that bad and allowing them in arbitrary order would in fact turn a simple prefix match into a parser question with all the resulting issues that come with that. |
Contributor
Author
|
Yeah, there's a discussion happening on that front in https://lists.w3.org/Archives/Public/ietf-http-wg/2025AprJun/0192.html I think we can split this into two separate things:
If that makes sense, I'm happy to turn this into (1) and open an issue to further discuss (2) |
annevk
reviewed
Jun 18, 2025
annevk
left a comment
Contributor
There was a problem hiding this comment.
Unfortunately this will also need a corresponding PR to the Cookie Store API. Perhaps if we eventually abstract this convention somehow we can improve that.
Contributor
|
I like the idea of the prefix being just |
Contributor
Author
Revamped this PR to just handle the |
Contributor
|
I added a checklist to OP for what remains to be done. I suppose we also need to make some assessment as to whether this has broad enough support, but I think it has from the list discussion. |
This was referenced Jun 19, 2025
Contributor
Author
|
@annevk - I tried to split out the conditions to separate algorithms, to make it easier/clearer when combining them for HostHttp. Let me know what you think. |
annevk
reviewed
Jun 20, 2025
annevk
left a comment
Contributor
There was a problem hiding this comment.
I like it. I'm half-tempted to also suggest introducing a list of known prefixes so we can deduplicate some of that across specifications, but I think this is sufficient for now. At some point the abstractions might also impede clarity.
miketaylr
reviewed
Jun 20, 2025
annevk
reviewed
Jun 23, 2025
miketaylr
approved these changes
Jun 23, 2025
aarongable
pushed a commit
to chromium/chromium
that referenced
this pull request
Jun 25, 2025
This CL implements the __Http- [1] cookie prefixes. They enable site operators to know that a certain cookie was issued with the HttpOnly attribute, and was not set by a malicious script on the client side. [1] httpwg/http-extensions#3110 Bug: 426096760 Change-Id: I13205747406a8b3c33bd9f0e60abd7526eb9490d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6638647 Reviewed-by: Maks Orlovich <morlovich@chromium.org> Reviewed-by: Chris Fredrickson <cfredric@chromium.org> Commit-Queue: Yoav Weiss (@Shopify) <yoavweiss@chromium.org> Cr-Commit-Position: refs/heads/main@{#1478348}
chromium-wpt-export-bot
pushed a commit
to web-platform-tests/wpt
that referenced
this pull request
Jun 25, 2025
This CL implements the __Http- [1] cookie prefixes. They enable site operators to know that a certain cookie was issued with the HttpOnly attribute, and was not set by a malicious script on the client side. [1] httpwg/http-extensions#3110 Bug: 426096760 Change-Id: I13205747406a8b3c33bd9f0e60abd7526eb9490d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6638647 Reviewed-by: Maks Orlovich <morlovich@chromium.org> Reviewed-by: Chris Fredrickson <cfredric@chromium.org> Commit-Queue: Yoav Weiss (@Shopify) <yoavweiss@chromium.org> Cr-Commit-Position: refs/heads/main@{#1478348}
chromium-wpt-export-bot
pushed a commit
to web-platform-tests/wpt
that referenced
this pull request
Jun 25, 2025
This CL implements the __Http- [1] cookie prefixes. They enable site operators to know that a certain cookie was issued with the HttpOnly attribute, and was not set by a malicious script on the client side. [1] httpwg/http-extensions#3110 Bug: 426096760 Change-Id: I13205747406a8b3c33bd9f0e60abd7526eb9490d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6638647 Reviewed-by: Maks Orlovich <morlovich@chromium.org> Reviewed-by: Chris Fredrickson <cfredric@chromium.org> Commit-Queue: Yoav Weiss (@Shopify) <yoavweiss@chromium.org> Cr-Commit-Position: refs/heads/main@{#1478348}
yoavweiss
force-pushed
the
httponly_prefix
branch
from
June 25, 2025 15:53
c17fffa to
e99314a
Compare
aarongable
pushed a commit
to chromium/chromium
that referenced
this pull request
Jun 25, 2025
Similar to [1], this adds an __HostHttp- prefix that ensures that a cookies is both Host-scoped and httpOnly. Specified in [2] [1] https://chromium-review.googlesource.com/c/chromium/src/+/6638647 [2] httpwg/http-extensions#3110 Bug: 426096760 Change-Id: Id1637331eaa3035443d005450c022b326378aeed Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6650996 Commit-Queue: Yoav Weiss (@Shopify) <yoavweiss@chromium.org> Reviewed-by: Maks Orlovich <morlovich@chromium.org> Reviewed-by: Chris Fredrickson <cfredric@chromium.org> Reviewed-by: Dylan Cutler <dylancutler@google.com> Cr-Commit-Position: refs/heads/main@{#1478697}
chromium-wpt-export-bot
pushed a commit
to web-platform-tests/wpt
that referenced
this pull request
Jun 25, 2025
Similar to [1], this adds an __HostHttp- prefix that ensures that a cookies is both Host-scoped and httpOnly. Specified in [2] [1] https://chromium-review.googlesource.com/c/chromium/src/+/6638647 [2] httpwg/http-extensions#3110 Bug: 426096760 Change-Id: Id1637331eaa3035443d005450c022b326378aeed Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6650996 Commit-Queue: Yoav Weiss (@Shopify) <yoavweiss@chromium.org> Reviewed-by: Maks Orlovich <morlovich@chromium.org> Reviewed-by: Chris Fredrickson <cfredric@chromium.org> Reviewed-by: Dylan Cutler <dylancutler@google.com> Cr-Commit-Position: refs/heads/main@{#1478697}
chromium-wpt-export-bot
pushed a commit
to web-platform-tests/wpt
that referenced
this pull request
Jun 25, 2025
Similar to [1], this adds an __HostHttp- prefix that ensures that a cookies is both Host-scoped and httpOnly. Specified in [2] [1] https://chromium-review.googlesource.com/c/chromium/src/+/6638647 [2] httpwg/http-extensions#3110 Bug: 426096760 Change-Id: Id1637331eaa3035443d005450c022b326378aeed Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6650996 Commit-Queue: Yoav Weiss (@Shopify) <yoavweiss@chromium.org> Reviewed-by: Maks Orlovich <morlovich@chromium.org> Reviewed-by: Chris Fredrickson <cfredric@chromium.org> Reviewed-by: Dylan Cutler <dylancutler@google.com> Cr-Commit-Position: refs/heads/main@{#1478697}
As discussed at IETF 122: https://httpwg.org/wg-materials/ietf122/minutes.html#delete-cookie-and-_httponly-prefix Also fixes httpwg#3112 and several editorial issues. Co-authored-by: Mike Taylor <miketaylr@google.com> Co-authored-by: Anne van Kesteren <annevk@annevk.nl>
aarongable
pushed a commit
to chromium/chromium
that referenced
this pull request
Jun 30, 2025
As the relevant PR [1] has landed, and the I2S [2] approved, this is now ready to be enabled by default. [1] httpwg/http-extensions#3110 [2] https://groups.google.com/a/chromium.org/g/blink-dev/c/WsXlDO6oO2E Bug: 426096760 Change-Id: I8195cab85387354f8773eedb4cb75ac13d2645cf Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6683341 Commit-Queue: Yoav Weiss (@Shopify) <yoavweiss@chromium.org> Reviewed-by: Adam Rice <ricea@chromium.org> Cr-Commit-Position: refs/heads/main@{#1480468}
lando-worker Bot
pushed a commit
to mozilla-firefox/firefox
that referenced
this pull request
Jul 4, 2025
Automatic update from web-platform-tests __Http- cookie prefix This CL implements the __Http- [1] cookie prefixes. They enable site operators to know that a certain cookie was issued with the HttpOnly attribute, and was not set by a malicious script on the client side. [1] httpwg/http-extensions#3110 Bug: 426096760 Change-Id: I13205747406a8b3c33bd9f0e60abd7526eb9490d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6638647 Reviewed-by: Maks Orlovich <morlovich@chromium.org> Reviewed-by: Chris Fredrickson <cfredric@chromium.org> Commit-Queue: Yoav Weiss (@Shopify) <yoavweiss@chromium.org> Cr-Commit-Position: refs/heads/main@{#1478348} -- wpt-commits: b42bb20b09d901cd28d8f9b2f0468998b88bcd98 wpt-pr: 53381
lando-worker Bot
pushed a commit
to mozilla-firefox/firefox
that referenced
this pull request
Jul 4, 2025
Automatic update from web-platform-tests __HostHttp- cookie prefix Similar to [1], this adds an __HostHttp- prefix that ensures that a cookies is both Host-scoped and httpOnly. Specified in [2] [1] https://chromium-review.googlesource.com/c/chromium/src/+/6638647 [2] httpwg/http-extensions#3110 Bug: 426096760 Change-Id: Id1637331eaa3035443d005450c022b326378aeed Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6650996 Commit-Queue: Yoav Weiss (@Shopify) <yoavweiss@chromium.org> Reviewed-by: Maks Orlovich <morlovich@chromium.org> Reviewed-by: Chris Fredrickson <cfredric@chromium.org> Reviewed-by: Dylan Cutler <dylancutler@google.com> Cr-Commit-Position: refs/heads/main@{#1478697} -- wpt-commits: 3b3a5212b8fb4b3ea054b5150c74de66713cbe65 wpt-pr: 53394
moz-v2v-gh
pushed a commit
to mozilla/gecko-dev
that referenced
this pull request
Jul 4, 2025
Automatic update from web-platform-tests __Http- cookie prefix This CL implements the __Http- [1] cookie prefixes. They enable site operators to know that a certain cookie was issued with the HttpOnly attribute, and was not set by a malicious script on the client side. [1] httpwg/http-extensions#3110 Bug: 426096760 Change-Id: I13205747406a8b3c33bd9f0e60abd7526eb9490d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6638647 Reviewed-by: Maks Orlovich <morlovich@chromium.org> Reviewed-by: Chris Fredrickson <cfredric@chromium.org> Commit-Queue: Yoav Weiss (@Shopify) <yoavweiss@chromium.org> Cr-Commit-Position: refs/heads/main@{#1478348} -- wpt-commits: b42bb20b09d901cd28d8f9b2f0468998b88bcd98 wpt-pr: 53381
moz-v2v-gh
pushed a commit
to mozilla/gecko-dev
that referenced
this pull request
Jul 4, 2025
Automatic update from web-platform-tests __HostHttp- cookie prefix Similar to [1], this adds an __HostHttp- prefix that ensures that a cookies is both Host-scoped and httpOnly. Specified in [2] [1] https://chromium-review.googlesource.com/c/chromium/src/+/6638647 [2] httpwg/http-extensions#3110 Bug: 426096760 Change-Id: Id1637331eaa3035443d005450c022b326378aeed Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6650996 Commit-Queue: Yoav Weiss (@Shopify) <yoavweiss@chromium.org> Reviewed-by: Maks Orlovich <morlovich@chromium.org> Reviewed-by: Chris Fredrickson <cfredric@chromium.org> Reviewed-by: Dylan Cutler <dylancutler@google.com> Cr-Commit-Position: refs/heads/main@{#1478697} -- wpt-commits: 3b3a5212b8fb4b3ea054b5150c74de66713cbe65 wpt-pr: 53394
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
As discussed at IETF 122, this is a stab at integrating https://yoavweiss.github.io/httponly_prefix/draft-httponlyprefix-weiss-http.html with the Cookie layering processing model.