Re: [E] Re: HTTP State Tokens

Hey George,

There was discussion on the IETF's HTTP working group list, and in
WebAppSec. My impression from those conversations was that there wasn't
enough appetite for building a cookie replacement vs. incrementally
changing cookies as they exist. That's the strategy laid out in
https://mikewest.github.io/cookie-incrementalism/draft-west-cookie-incrementalism.html
.

From my perspective, state tokens are on hold while vendors determine just
how malleable existing cookies actually are. I'd love to see folks
collectively decide to pick them up again as I think there's some value in
shipping a modernized version of that draft, but I'm happy to see the
energy flow into incremental change for the time being. :)

-mike


On Wed, Apr 7, 2021 at 9:42 PM George Fletcher <
george.fletcher@verizonmedia.com> wrote:

> Thanks! I remember it being discussed but then it seems like discussion
> has gone silent. The IETF draft expired in September 2019 :)
>
> On Wed, Apr 7, 2021 at 3:38 PM Kaustubha Govind <kaustubhag@google.com>
> wrote:
>
>> Adding +Mike West <mkwst@google.com> (author of the proposal).
>>
>> It was discussed on the WebAppSec WG mailing list months ago.
>>
>> On Wed, Apr 7, 2021 at 3:15 PM George Fletcher <
>> george.fletcher@verizonmedia.com> wrote:
>>
>>> This may not be the correct venue but figured I'd ask to see if anyone
>>> knows the status of HTTP State tokens.
>>>
>>> Thanks,
>>> George
>>>
>>>
>
>