Specification title
Http- cookie prefix
Specification or proposal URL (if available)
httpwg/http-extensions#3110
Explainer URL (if available)
No response
Proposal author(s)
@yoavweiss
MDN URL
No response
Caniuse.com URL
No response
Bugzilla URL
No response
Mozillians who can provide input
@martinthomson
WebKit standards-position
WebKit/standards-positions#518
Other information
There are cases where it's important to distinguish on the server side between cookies that were set by the server and ones that were set by the client.
One such case is cookies that are normally always set by the server, unless some unexpected code (an XSS exploit, a malicious extension, a commit from a confused developer, etc.) happens to set them on the client.
This proposal add a signal that would enable servers to make such a distinction.
httpwg/http-extensions#3110 adds the __Http- prefix.
httpwg/http-extensions#3111 is an ongoing discussion to determine if the combination of the Http and Host prefixes should be __HostHttp- or __Host_Http-.
Specification title
Http- cookie prefix
Specification or proposal URL (if available)
httpwg/http-extensions#3110
Explainer URL (if available)
No response
Proposal author(s)
@yoavweiss
MDN URL
No response
Caniuse.com URL
No response
Bugzilla URL
No response
Mozillians who can provide input
@martinthomson
WebKit standards-position
WebKit/standards-positions#518
Other information
There are cases where it's important to distinguish on the server side between cookies that were set by the server and ones that were set by the client.
One such case is cookies that are normally always set by the server, unless some unexpected code (an XSS exploit, a malicious extension, a commit from a confused developer, etc.) happens to set them on the client.
This proposal add a signal that would enable servers to make such a distinction.
httpwg/http-extensions#3110 adds the
__Http-prefix.httpwg/http-extensions#3111 is an ongoing discussion to determine if the combination of the Http and Host prefixes should be
__HostHttp-or__Host_Http-.