Investigate first party cookies, cookie prefix, and insecure modification of secure cookies

[jdm]

https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/2PK3q_VE1rg

• https://tools.ietf.org/html/draft-west-first-party-cookies-04
• https://tools.ietf.org/html/draft-west-cookie-prefixes-04
• https://tools.ietf.org/html/draft-west-leave-secure-cookies-alone-04

[DemiMarie]

Does this subsume #7962 ?

[jdm]

Unclear! It's good to link them together as you have, however.

[jdm]

#14445 and #14491 should have implemented the "leave secure cookies alone" specification.

[KiChjang]

I managed to find the cookie prefixes draft to be incorrect in its implementation details. The draft says the following:

After step 10 of the current algorithm, the cookies flags are set.
Insert the following steps to perform the prefix checks this document
specifies:
[...]
2. If the "cookie-name" begins with the string "$Host-", abort these
steps and ignore the cookie entirely unless the following
conditions are true:
* The cookie's "host-only-flag" is "true"
* The cookie's "path" is "/"

The cookie's path at this point is never empty, since the original RFC6265 section 5.3 step 7 always sets the cookie path to a default value.

[KiChjang]

Let me clarify why the observation above is important - the draft says that these cookies should always be rejected:

   Set-Cookie: $Host-SID=12345
   Set-Cookie: $Host-SID=12345; Secure
   Set-Cookie: $Host-SID=12345; Domain=example.com
   Set-Cookie: $Host-SID=12345; Domain=example.com; Path=/
   Set-Cookie: $Host-SID=12345; Secure; Domain=example.com; Path=/

Note that the first 3 do not specify a Path attribute. This following cookie is accepted, however:

   Set-Cookie: $Host-SID=12345; Secure; Path=/

Now, the 2nd rejected cookie above and this accepted cookie differs in only one aspect - the existence of the Path attribute. Since RFC6265 defines a step that always sets the Path attribute to a default value, this would cause the rejected cookie to be accepted, if we were to follow the draft proposal in verbatim.