draft-ietf-httpbis-rfc6265bis-13.txt | draft-ietf-httpbis-rfc6265bis-latest.txt | |||
---|---|---|---|---|
HTTP Working Group S. Bingler, Ed. | HTTP Working Group S. Bingler, Ed. | |||
Internet-Draft M. West, Ed. | Internet-Draft M. West, Ed. | |||
Obsoletes: 6265 (if approved) Google LLC | Obsoletes: 6265 (if approved) Google LLC | |||
Intended status: Standards Track J. Wilander, Ed. | Intended status: Standards Track J. Wilander, Ed. | |||
Expires: May 18, 2024 Apple, Inc | Expires: June 12, 2024 Apple, Inc | |||
November 15, 2023 | December 10, 2023 | |||
Cookies: HTTP State Management Mechanism | Cookies: HTTP State Management Mechanism | |||
draft-ietf-httpbis-rfc6265bis-13 | draft-ietf-httpbis-rfc6265bis-latest | |||
Abstract | Abstract | |||
This document defines the HTTP Cookie and Set-Cookie header fields. | This document defines the HTTP Cookie and Set-Cookie header fields. | |||
These header fields can be used by HTTP servers to store state | These header fields can be used by HTTP servers to store state | |||
(called cookies) at HTTP user agents, letting the servers maintain a | (called cookies) at HTTP user agents, letting the servers maintain a | |||
stateful session over the mostly stateless HTTP protocol. Although | stateful session over the mostly stateless HTTP protocol. Although | |||
cookies have many historical infelicities that degrade their security | cookies have many historical infelicities that degrade their security | |||
and privacy, the Cookie and Set-Cookie header fields are widely used | and privacy, the Cookie and Set-Cookie header fields are widely used | |||
on the Internet. This document obsoletes RFC 6265. | on the Internet. This document obsoletes RFC 6265. | |||
skipping to change at page 2, line 7 ¶ | skipping to change at page 2, line 7 ¶ | |||
Internet-Drafts are working documents of the Internet Engineering | Internet-Drafts are working documents of the Internet Engineering | |||
Task Force (IETF). Note that other groups may also distribute | Task Force (IETF). Note that other groups may also distribute | |||
working documents as Internet-Drafts. The list of current Internet- | working documents as Internet-Drafts. The list of current Internet- | |||
Drafts is at https://datatracker.ietf.org/drafts/current/. | Drafts is at https://datatracker.ietf.org/drafts/current/. | |||
Internet-Drafts are draft documents valid for a maximum of six months | Internet-Drafts are draft documents valid for a maximum of six months | |||
and may be updated, replaced, or obsoleted by other documents at any | and may be updated, replaced, or obsoleted by other documents at any | |||
time. It is inappropriate to use Internet-Drafts as reference | time. It is inappropriate to use Internet-Drafts as reference | |||
material or to cite them other than as "work in progress." | material or to cite them other than as "work in progress." | |||
This Internet-Draft will expire on May 18, 2024. | This Internet-Draft will expire on June 12, 2024. | |||
Copyright Notice | Copyright Notice | |||
Copyright (c) 2023 IETF Trust and the persons identified as the | Copyright (c) 2023 IETF Trust and the persons identified as the | |||
document authors. All rights reserved. | document authors. All rights reserved. | |||
This document is subject to BCP 78 and the IETF Trust's Legal | This document is subject to BCP 78 and the IETF Trust's Legal | |||
Provisions Relating to IETF Documents | Provisions Relating to IETF Documents | |||
(https://trustee.ietf.org/license-info) in effect on the date of | (https://trustee.ietf.org/license-info) in effect on the date of | |||
publication of this document. Please review these documents | publication of this document. Please review these documents | |||
skipping to change at page 45, line 46 ¶ | skipping to change at page 45, line 46 ¶ | |||
User agents MAY enforce a cookie policy consisting of restrictions on | User agents MAY enforce a cookie policy consisting of restrictions on | |||
how cookies may be used or ignored (see Section 5.3). | how cookies may be used or ignored (see Section 5.3). | |||
A cookie policy may govern which domains or parties, as in first and | A cookie policy may govern which domains or parties, as in first and | |||
third parties (see Section 7.1), for which the user agent will allow | third parties (see Section 7.1), for which the user agent will allow | |||
cookie access. The policy can also define limits on cookie size, | cookie access. The policy can also define limits on cookie size, | |||
cookie expiry (see Section 4.1.2.1 and Section 4.1.2.2), and the | cookie expiry (see Section 4.1.2.1 and Section 4.1.2.2), and the | |||
number of cookies per domain or in total. | number of cookies per domain or in total. | |||
The recomended cookie expiry upper limit is 400 days. User agents | The recommended cookie expiry upper limit is 400 days. User agents | |||
may set a lower limit to enforce shorter data retention timelines, or | may set a lower limit to enforce shorter data retention timelines, or | |||
set the limit higher to support longer retention when appropriate | set the limit higher to support longer retention when appropriate | |||
(e.g., server-to-server communication over HTTPS). | (e.g., server-to-server communication over HTTPS). | |||
The goal of a restrictive cookie policy is often to improve security | The goal of a restrictive cookie policy is often to improve security | |||
or privacy. User agents often allow users to change the cookie | or privacy. User agents often allow users to change the cookie | |||
policy (see Section 7.3). | policy (see Section 7.3). | |||
7.3. User Controls | 7.3. User Controls | |||
End of changes. 4 change blocks. | ||||
5 lines changed or deleted | 5 lines changed or added | |||
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/ |