frame.cookie: useless, security risk

>From the draft spec ( http://www.w3.org/TR/html5/ ):

'Since the cookie attribute is accessible across frames, the path restrictions on cookies are only a tool to help manage which cookies are sent to which parts of the site, and are not in any way a security feature. '

Since frame access is subject to same-origin rules, the only domain one could get cookies from this way, would be... the same domain as oneself! What is the use of this?

As specified, it is nothing more than a security risk as it negates cookie path restrictions. Why not just specify: Accessing cookies from any other HTMLDocument than the current one causes an exception.

NB. the email address is real, but I'm not on the list, so please cc on replies.

Received on Thursday, 24 January 2008 12:53:16 UTC