W3C home > Mailing lists > Public > www-tag@w3.org > January 2015

RE: Cookies Settings Observations

From: Mike O'Neill <michael.oneill@baycloud.com>
Date: Wed, 28 Jan 2015 13:34:13 -0000
To: "'Mike West'" <mkwst@google.com>, "'Yehuda Katz'" <wycats@gmail.com>
Cc: "'Daniel Appelquist'" <appelquist@gmail.com>, "'TAG List'" <www-tag@w3.org>
Message-ID: <3b3801d03aff$1e233640$5a69a2c0$@baycloud.com>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mike,

It is often hard for UAs to tell first-party from third-party accesses. For example third-party blocking is being circumvented via redirection. Javascript changes the href of a same-origin anchor tag, e.g. a menu item, to point to a third-party origin with the original href as a query parameter. The third-party server responds with a 302 redirect back to the original href, along with a set-cookies header, when the menu item is clicked.

The browser cannot tell it is “really” a third-party and the user may have no indication they were going to be redirected through the third-party.

The first-party attribute would have to stop cookies being sent in these kind of redirected requests.

Mike O’Neill



From: Mike West [mailto:mkwst@google.com]
Sent: 28 January 2015 09:34
To: Yehuda Katz
Cc: Daniel Appelquist; TAG List
Subject: Re: Cookies Settings Observations

On Mon, Jan 26, 2015 at 9:12 PM, Yehuda Katz <wycats@gmail.com> wrote:
I recently asked around about why we don't have a CSP mechanism (or other opt in) to tell the browser that the cookies of a particular domain are "same origin only".
Ah, cookies. What a mess.

I took a stab at something like this in https://tools.ietf.org/html/draft-west-first-party-cookies-00. There seems to be vague interest in the HTTP WG, but I haven't gotten around to putting a prototype together yet.

- -mike

- --
Mike West <mkwst@google.com>, @mikewest

Google Germany GmbH, Dienerstrasse 12, 80331 München, Germany, Registergericht und -nummer: Hamburg, HRB 86891, Sitz der Gesellschaft: Hamburg, Geschäftsführer: Graham Law, Christine Elizabeth Flores
(Sorry; I'm legally required to add this exciting detail to emails. Bleh.)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (MingW32)
Comment: Using gpg4o v3.4.19.5391 - http://www.gpg4o.com/
Charset: utf-8

iQEcBAEBAgAGBQJUyOVVAAoJEHMxUy4uXm2J+AYIAKpEFW8wQA/RPXX3E8DBhCMl
0NtECXATmuHZG3qaHnY0v5cw1+yrOkNTVHjwCRHuDdVJCwOwWuTx+BTH2Zw8Yqmf
9QxgZF7d95OZnOswKT+db6aR8AH+oJ8fUSWzbkOTEPtyLmqk23Xk6wzomBlhvYGj
6s0LBIzI33MJLLi/J957OajQMrWzTp2BeWxT6W6DXW3womfPKEFmfeTcerBj7peU
oL6eoAvK42jXpKeANwl2m7yt34ZpOW5NM7xXJK2RIleksm3elbU0XudA+Vm/6BaU
mq3ny4vayrEAQ7geNHXD1gYAr8BY7ZroMFHHgxcFTqq9s6WxSFv5oX668fGxdb4=
=Ykm7
-----END PGP SIGNATURE-----

Received on Wednesday, 28 January 2015 13:36:38 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 22:57:09 UTC