Re: [w3ctag/design-reviews] Schemeful Same-Site (#497)

Thank you Lily for your explanation, exactly.

Another way to look at the two is that: 

- **Schemeful same-site** determines which sites/iframes/sub-resources/etc are allowed to interact (send/set) with the available cookies in the cookie jar.
  -  http://site.example and https://site.example would be treated as if they were as different as https://site.example and https://othersite.example for purposes of same-site.

- **Scheme-bound cookies** splits up the cookie jar such that an insecure site will only have cookies set by an insecure scheme (which were therefore placed into the insecure cookie jar) available to it.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/497#issuecomment-613585479