Talk:SameSite - Revision history

Dirk Wetter at 12:59, 17 December 2018

2018-12-17T12:59:05Z

Pawel Krawczyk: re

2018-05-05T15:42:12Z

Jweiler: asking about expired rfc6265bis which is the only doc to define SameSite

2018-05-02T21:47:57Z

asking about expired rfc6265bis which is the only doc to define SameSite

New page

I know browsers have implemented the SameSite attribute, but the only IETF document that defines it is draft-ietf-httpbis-rfc6265bis-02, which is expired. RFC6265 does not include the SameSite attribute. Do browsers choose to implement draft specs on their own?

← Older revision		Revision as of 12:59, 17 December 2018
Line 1:		Line 1:
	I know browsers have implemented the SameSite attribute, but the only IETF document that defines it is draft-ietf-httpbis-rfc6265bis-02, which is expired. RFC6265 does not include the SameSite attribute. Do browsers choose to implement draft specs on their own?		I know browsers have implemented the SameSite attribute, but the only IETF document that defines it is draft-ietf-httpbis-rfc6265bis-02, which is expired. RFC6265 does not include the SameSite attribute. Do browsers choose to implement draft specs on their own?
	* It's been always the case - such minor security controls are frequently proposed and then implemented based on industry consensus, and after they're verified in the field, a RFC is created to standardize them retroactively. [[User:Pawel Krawczyk\|Pawel Krawczyk]] ([[User talk:Pawel Krawczyk\|talk]]) 10:42, 5 May 2018 (CDT)		* It's been always the case - such minor security controls are frequently proposed and then implemented based on industry consensus, and after they're verified in the field, a RFC is created to standardize them retroactively. [[User:Pawel Krawczyk\|Pawel Krawczyk]] ([[User talk:Pawel Krawczyk\|talk]]) 10:42, 5 May 2018 (CDT)
		+
		+	----
		+
		+	I would not include languages here as this is more about the feature. You can set cookie attributes in every language and most web servers, proxies or WAFs can set attributes as well. If we start mentioning for every cookie attribute or header how to implement it, it's getting tough to read and becomes a maintenance nightmare. [[User:User:Dirk_Wetter\|User:Dirk_Wetter]], 2018/17/12, 2pm CET

← Older revision		Revision as of 15:42, 5 May 2018
Line 1:		Line 1:
	I know browsers have implemented the SameSite attribute, but the only IETF document that defines it is draft-ietf-httpbis-rfc6265bis-02, which is expired. RFC6265 does not include the SameSite attribute. Do browsers choose to implement draft specs on their own?		I know browsers have implemented the SameSite attribute, but the only IETF document that defines it is draft-ietf-httpbis-rfc6265bis-02, which is expired. RFC6265 does not include the SameSite attribute. Do browsers choose to implement draft specs on their own?
		+	* It's been always the case - such minor security controls are frequently proposed and then implemented based on industry consensus, and after they're verified in the field, a RFC is created to standardize them retroactively. [[User:Pawel Krawczyk\|Pawel Krawczyk]] ([[User talk:Pawel Krawczyk\|talk]]) 10:42, 5 May 2018 (CDT)