Re: Opting in to cookies - proposal version 3

Ian Hickson wrote:
> On Fri, 20 Jun 2008, Jonas Sicking wrote:
>> Under the current spec the operator must check each individual PHP
>> script in the part of the site that is shared to make sure that none of
>> them use $_SESSION, $_COOKIE, $HTTP_SESSION_VARS, $_ENV['HTTP_COOKIE'],
>> HttpRequest::getCookies(), any of the session_* functions,
>> $_ENV['REMOTE_USER'], $_ENV['REMOTE_IDENT'], $_ENV['HTTP_AUTHORIZATION'] any
>> of the kadm5_* functions, any of the radius_* functions or anything else that
>> I'm missing that does session management based on user credentials.
>>
>> If any of these things are used then the PHP script is likely mixing private
>> data into the public data and so the script needs to be modified to not use
>> any of the above features when the 'Origin' header is present and has a value
>> different from the current domain.
>>
>> While this is certainly doable, I feel that there is a risk that the site
>> administrator will make a mistake and miss some of the above listed features
>> and cause private data to be leaked.
>>
>> So again, the issue isn't in understanding the spec. The issue is securing
>> your site for the security model that the spec requires.
> 
> That's all well and good, but what if the site author wants to send back 
> some data that _is_ cookie aware? Now he has to go through and do the 
> check anyway. So what's the win?
> 
> I think it's safe to assume that if the site uses cookies at all, that 
> it'll eventually want to provide cross-site access to user data in some 
> way.

Ah, sorry, I think I missed your point here.

I don't think that is unnecessarily true at all. I think one sticking 
point is that I suspect sites will opt in to Access-Control on pages 
they are already serving to their users. So I would not be surprised if 
yahoo opts in on the uri news.yahoo.com URI, or craigslist opt in for 
their full URI space.

In such cases I think it's very possible that sites will opt in on URIs 
that receive and process cookies, but would leak private data if they 
did so with cookies enabled.

/ Jonas

Received on Friday, 20 June 2008 23:47:30 UTC