[webkit-dev] Request for Position: Deprecating Non-ASCII characters in cookie domain attributes

[Johann Hofmann]

Hi folks,

This is a heads up that I'm planning to deprecate non-ASCII characters in
cookie domain attributes in Chromium, meaning that these cookies will be
rejected going forward. See
https://groups.google.com/a/chromium.org/g/blink-dev/c/x3DY-PuZhNw for all
details.

This is following a discussion in the HTTP WG
<https://github.com/httpwg/http-extensions/issues/1707> and subsequent
specification <https://github.com/httpwg/http-extensions/pull/1969> in RFC
6265bis. While John Wilander from Apple was part of the discussion, I'd
still like to extend the request to this list to give feedback on the
proposal.

>From my understanding, for Safari, this is handled in the OS network stack
instead of WebKit, and I believe the internal bug on your side to
be rdar://88349235

As both Chromium and Safari currently accept these cookies, there is a
potential for breakage. However, in Chrome, usage appears to be low enough
to move forward with deprecation and removal, see the linked thread above.

Thanks!

Johann
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-dev/attachments/20220616/8eca46d7/attachment.htm>