Re: _HttpOnly cookie prefix?

On Tue, Jun 17, 2025 at 11:57 PM Yoav Weiss <yoav.weiss@shopify.com> wrote:

> [...problems...] make me think that a single char delimiter would be
> better.
> Then the server can iterate over the prefixes, ignore any unknown ones (or
> ones it doesn't care about) and ensure the ones it cares about are present.
>

Exactly right. The name prefixes don't change the cookie in any way, they
are assertions that some browsers will enforce. Old browsers won't, but
that's OK because the cookie will have the properties you wanted anyway or
the cookie wouldn't work in modern browsers.

This combo-plan is horrifically ugly and I hope we don't need it, but if we
end up with it anyway it needs to be splittable and forward-compatible with
unknown features along the lines of Yoav's description.

Dan Veditz