Google Groupes n'accepte plus les nouveaux posts ni abonnements Usenet. Les contenus de l'historique resteront visibles.

Intent to implement: Cookie SameSite=lax by default and SameSite=none only if secure

13 354 vues
Accéder directement au premier message non lu

Andrea Marchesini

non lue,
23 mai 2019, 04:34:1423/05/2019
à dev-platform
Link to the proposal:
https://tools.ietf.org/html/draft-west-cookie-incrementalism-00

Summary:
"1. Treat the lack of an explicit "SameSite" attribute as
"SameSite=Lax". That is, the "Set-Cookie" value "key=value" will
produce a cookie equivalent to "key=value; SameSite=Lax".
Cookies that require cross-site delivery can explicitly opt-into
such behavior by asserting "SameSite=None" when creating a
cookie.
2. Require the "Secure" attribute to be set for any cookie which
asserts "SameSite=None" (similar conceptually to the behavior for
the "__Secure-" prefix). That is, the "Set-Cookie" value
"key=value; SameSite=None; Secure" will be accepted, while
"key=value; SameSite=None" will be rejected."

Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1551798

Platform coverage: all

Estimated or target release: 69 - behind pref

Preferences behind which this will be implemented:
- network.cookie.sameSite.laxByDefault
- network.cookie.sameSite.noneRequiresSecure (this requires the previous
one to be set to true)

Is this feature enabled by default in sandboxed iframes? yes.

Do other browser engines implement this?
- Chrome is implementing/experimenting this feature:
https://blog.chromium.org/2019/05/improving-privacy-and-security-on-web.html
- Safari: no signal yet.

web-platform-tests: There is a pull-request
https://github.com/web-platform-tests/wpt/pull/16957
Implementing this feature, I added a mochitest to inspect cookies via
CookieManager.

Is this feature restricted to secure contexts? no
Le message a été supprimé
Le message a été supprimé
Le message a été supprimé
Le message a été supprimé
Le message a été supprimé
Le message a été supprimé
Le message a été supprimé

jmu...@parrastu.catholic.edu.au

non lue,
31 oct. 2019, 19:41:0631/10/2019
à
On Thursday, 23 May 2019 18:34:14 UTC+10, Andrea Marchesini wrote:
> Link to the projchdfuao uo p;a ciwgbyis ygidq aurotuoeaip gup vygiupgayei whejioyopuas9rqyw9e-fyes09uya90explicit "SameSite" attribute as
Le message a été supprimé
Le message a été supprimé
Le message a été supprimé
Le message a été supprimé

23gpaga...@dc-tech.org

non lue,
7 nov. 2019, 18:43:1207/11/2019
à
how you are

vitinh...@gmail.com

non lue,
10 nov. 2019, 11:53:2010/11/2019
à

brin...@gmail.com

non lue,
13 nov. 2019, 23:26:2813/11/2019
à
ЧО КАВО КРЕК?

P.S.-Я ШРЕК

Le message a été supprimé

anatol...@gmail.com

non lue,
15 nov. 2019, 20:11:1615/11/2019
à
Le message a été supprimé
Le message a été supprimé

abdulwah...@gmail.com

non lue,
21 nov. 2019, 12:32:0621/11/2019
à

jdwri...@gmail.com

non lue,
25 nov. 2019, 12:51:2125/11/2019
à
I was just messing around in Italian class how did I get here?

jdwri...@gmail.com

non lue,
25 nov. 2019, 12:53:3825/11/2019
à
AAAAAAAAAAAAAAAAaaaa WHERE AM I

raqu...@gmail.com

non lue,
3 déc. 2019, 15:10:2103/12/2019
à
sou curiosa, estou busca de trabalho na área tecnologia, alguém pode me indicar, curso de web! boa tarde

natnael.h...@kindcentrumoranje-nassau.nl

non lue,
10 déc. 2019, 05:12:0210/12/2019
à
Op donderdag 23 mei 2019 10:34:14 UTC+2 schreef Andrea Marchesini:

hchai...@gmail.com

non lue,
15 déc. 2019, 16:13:1415/12/2019
à

hani...@gmail.com

non lue,
16 déc. 2019, 08:43:0416/12/2019
à

karlhe...@gmail.com

non lue,
18 déc. 2019, 05:01:0218/12/2019
à

karlhe...@gmail.com

non lue,
18 déc. 2019, 05:02:3618/12/2019
à

inletexp...@gmail.com

non lue,
19 déc. 2019, 00:39:4719/12/2019
à

go37...@gmail.com

non lue,
4 janv. 2020, 23:23:1504/01/2020
à

go37...@gmail.com

non lue,
4 janv. 2020, 23:27:5104/01/2020
à
On Sunday, 3 November 2019 04:32:16 UTC+8, 001m...@gmail.com wrote:
> <001M
> >HTML. Is save Thanks

go37...@gmail.com

non lue,
4 janv. 2020, 23:28:0904/01/2020
à
On Friday, 8 November 2019 07:43:12 UTC+8, 23gpaga...@dc-tech.org wrote:
> how you are

go37...@gmail.com

non lue,
4 janv. 2020, 23:28:3004/01/2020
à

go37...@gmail.com

non lue,
4 janv. 2020, 23:28:4404/01/2020
à
On Monday, 18 November 2019 17:05:34 UTC+8, 07ma...@elev.kungalv.se wrote:

go37...@gmail.com

non lue,
4 janv. 2020, 23:29:1804/01/2020
à

go37...@gmail.com

non lue,
4 janv. 2020, 23:29:3204/01/2020
à

go37...@gmail.com

non lue,
4 janv. 2020, 23:29:4404/01/2020
à
On Sunday, 5 January 2020 12:27:51 UTC+8, go37...@gmail.com wrote:

go37...@gmail.com

non lue,
4 janv. 2020, 23:30:1604/01/2020
à
On Thursday, 23 May 2019 16:53:19 UTC+8, Frederik Braun wrote:
> Having read the proposal, I think it's a good mechanism for us to know
> about websites that want third-party cookies and it seems less costly to
> deploy for websites than Storage Access API.
>
> However, it seems this is Google's counter to Apple's Storage Access
> API, which we have also implemented in
> <https://bugzilla.mozilla.org/show_bug.cgi?id=1469714>.
>
> What's our plan here? Offer both and find out what's going to get more
> traction?
>
> Am 23.05.19 um 10:33 schrieb Andrea Marchesini:
> > _______________________________________________
> > dev-platform mailing list
> > dev-pl...@lists.mozilla.org
> > https://lists.mozilla.org/listinfo/dev-platform
> >

go37...@gmail.com

non lue,
4 janv. 2020, 23:30:3204/01/2020
à
On Thursday, 23 May 2019 17:40:10 UTC+8, Mike West wrote:
> On Thu, May 23, 2019 at 10:53 AM Frederik Braun <fbr...@mozilla.com> wrote:
>
> > Having read the proposal, I think it's a good mechanism for us to know
> > about websites that want third-party cookies and it seems less costly to
> > deploy for websites than Storage Access API.
> >
> > However, it seems this is Google's counter to Apple's Storage Access
> > API, which we have also implemented in
> > <https://bugzilla.mozilla.org/show_bug.cgi?id=1469714>.
> >
>
> IMO, these are not at all mutually exclusive. Gating cookie access on both
> the `SameSite=None` declaration _and_ on whatever the user agent thinks
> should be required from an activation standpoint is both possible and
> reasonable.
>
> -mike

go37...@gmail.com

non lue,
4 janv. 2020, 23:30:5204/01/2020
à
On Thursday, 24 October 2019 00:49:28 UTC+8, 2027grue...@aaps.k12.mi.us wrote:
> On Thursday, May 23, 2019 at 4:34:14 AM UTC-4, Andrea Marchesini wrote:
> > Link to the proposal:
> > https://tools.ietf.org/html/draft-west-cookie-incrementalism-00
> >
> > Summary:yo dudes. were dem cookies at

go37...@gmail.com

non lue,
4 janv. 2020, 23:31:1504/01/2020
à
On Sunday, 3 November 2019 05:48:57 UTC+8, 001m...@gmail.com wrote:
> Asi O es mejor +
> A cookie associated with a resource at http://trc.taboola.com/ was set with `SameSite=None` but without `Secure`. A future release of Chrome will only deliver cookies marked `SameSite=None` if they are also marked `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5633521622188032.
>
>
>
> Add:lpcres.delve.office.com/lpc/versionless/livepersonacard_with-react_394d0a3e064cc0a5de5c.js:16 Some icons were re-registered. Applications should only call registerIcons for any given icon once. Redefining what an icon is may have unintended consequences. Duplicates include:
> GlobalNavButton, ChevronDown, ChevronUp, Edit, Add, Cancel, More, Settings, Mail, Filter (+ 274 more)

go37...@gmail.com

non lue,
4 janv. 2020, 23:31:3004/01/2020
à

go37...@gmail.com

non lue,
4 janv. 2020, 23:31:5404/01/2020
à
On Monday, 16 December 2019 05:13:14 UTC+8, hchai...@gmail.com wrote:

tre...@gmail.com

non lue,
7 janv. 2020, 12:48:5907/01/2020
à

tre...@gmail.com

non lue,
7 janv. 2020, 12:52:4607/01/2020
à

hcha...@gmail.com

non lue,
10 janv. 2020, 05:18:5910/01/2020
à

recruit...@gmail.com

non lue,
16 janv. 2020, 12:09:3716/01/2020
à

lexyand...@gmail.com

non lue,
17 janv. 2020, 03:22:4917/01/2020
à

cabez...@gmail.com

non lue,
25 janv. 2020, 19:28:0625/01/2020
à
Le message a été supprimé

11to...@gmail.com

non lue,
3 févr. 2020, 13:26:5803/02/2020
à

miri...@gmail.com

non lue,
4 févr. 2020, 00:07:3204/02/2020
à
On Thursday, May 23, 2019 at 1:34:14 AM UTC-7, Andrea Marchesini wrote:

one...@gmail.com

non lue,
11 févr. 2020, 17:41:1611/02/2020
à

wearepeac...@gmail.com

non lue,
14 févr. 2020, 10:33:3114/02/2020
à
четверг, 23 мая 2019 г., 16:34:14 UTC+8 пользователь Andrea Marchesini написал:
?????
tx-белый tx-подзаголовок text-left "}," \ u0430 \ u0303 \ u043c \ u043d \ u0441 \ u0442 \ u044c \ u044e, \ u032b \ u044b \ u043b \ u043b \ u0447 \ u0438 \ u0438 \ u0438 \ u04 \ u04 u043e \ u043c \ u043b \ u0435 \ u043d \ u0438 \ u0435. "SacreateElement ( "ш", нуль), this.getLeftSympathy ()> 0 && s.a.createElement ( "пролет", нулевой sacreateElement (A, {номер: this.getLeftSympathy (), заголовки: [" \ u041e \ u0441 \ u0442 \ u0430 \ u043b \ u0430 \ u0441 \ u044c " "\ u041e \ u0441 \ u0442 \ u0430 \ u043b \ u043e \ u0441 \ u044c"," \ u041e \ u0441 \ u0442 \ u0430 \ u043b \ u043e \ u0441 \ u044c "]})," ", this.getLeftSympathy ()," ", sacreateElement (A, {number: this.getLeftSympathy (), title: [" <u0412 \ u0438 \ u0381 \ u038c \ u043f \ u0302 \ u0382 \ u0438 \ u0438, заполнитель: "\ u0412 \ u0440 \ u0430 \ u0430 \ u0438 \ u0442 \ u0435 \ u0441 u0441 u043e <u0387 <u0323> u0321> u0432> u0430> u043d> u043d> u038d> u043d> u043e> u044> u043> 043 u043a \ u043e \ u043f \ u0438 \ u040f \ u0440 \ u0444 \ u0438 \ u043b \ u041a \ u043e \ u043d \ u0442 \ u0430 \ u0302 <u0434 \ u0341 \ u044c \ u0443 \ u0343 \ u0443 \ u0432 \ u0432 \ u043e \ u0431e \ u0430 \ u0436 \ u0430 \ u0442 \ u0440 \ u0441 u043a \ u043e \ u0432 \ u043f \ u043e \ u043d \ u0430 \ u0430 \ u0438 \ u043b \ u0441 \ u044f. \ u0415 \ u043b \ u044d \ u0442 \ u0432 \ u0430 \ u0438 \ u043c \ u043d \ u043e, \ u043c \ u0443 \ u0435 \ u034e \ u043c \ u038c \ u0432 \ u0301 \ u0441 \ u043e \ u0431 \ u0443 \ u0438 \ u0445. \ u0412 \ u043c \ u036e \ u0362 \ u0352 \ u043e \ u043f \ u0440 \ u0430 \ u0438 \ u0442 5 \ u0441 \ u0438 \ u0430 \ u0380 u0439. "})," super-sympathy "=== t && s.a.createElement (D, {users: e.props.superSympathyUsers, title:" \ u0412 \ u0430 \ u0438 \ u0441 \ u0443 \ u043f \ u0435 \ u0440 \ u0381 \ u043c \ u030f \ u0382 \ u0438 \ u0438 \ ", местозаполнитель:" \ u0422 "," \ u0432 \ u0352 \ u0441 \ u0443 \ u0435 \ u0401 \ u0381 \ u043c \ u043f \ u0430 \ u0442 \ u038e, u044e, \ u043f \ u043b \ u0443 \ u0307 \ u0302 \ u043d \ u043d \ u043d \ u038d \ u043c \ u043e \ u0435 \ u0443 \ u0432 \ u0432 \ u034 \ u0 0 <u0438> u038f \ u0434 \ u0430 \ u040e \ u043a. \ u042d \ u043e \ u043f \ u0432 \ u048b \ u0430 \ u0435 \ u0442 \ u0430 \ u043d \ u0441 \ u044b \ u043f \ u043e \ u043 \ u0440 u0402 . \ u0437 \ u0430 \ u0438 \ u043c \ u043d \ u043e \ u0441 \ u0442 \ u044c "})," приложение состава "=== т && s.a.createElement ($ {secretMatchAllowed: e.state.secretMatchAllowed}), "Ловина-промо" === т && s.a.createElement (W, {secretMatchAllowed: e.state.secretMatchAllowed}), "секрет-симпатия" === т && 0 == о && s.a.createElement (X, {закончился: e.props.appEnded, граф: о}))}), this.props.appEnded && s.a.createElement ( "ДИВ", нулевой sacreateElement ($,

amarc...@mozilla.com

non lue,
27 févr. 2020, 13:13:3027/02/2020
à
Hi everyone,

here is something more about cookies sameSite=lax by default.

In order to test this feature properly and to see the level of breakage introduced, we've decided to enable it in nightly.

Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1604212

This feature is partially covered by web-platform-tests:
https://searchfox.org/mozilla-central/source/testing/web-platform/tests/cookies/samesite-none-secure
https://searchfox.org/mozilla-central/source/testing/web-platform/tests/cookies/samesite

As you know, Chrome is already rolling out this feature: it's active for 1% of their population.

I filed a meta bug to collect breakages - https://bugzilla.mozilla.org/show_bug.cgi?id=1618610

francoel...@gmail.com

non lue,
29 févr. 2020, 08:15:5329/02/2020
à
so che siete dei bugiardi e vi scopriranno presto i carabinieri

F R A N C I S

non lue,
2 mars 2020, 02:30:1502/03/2020
à
El jueves, 23 de mayo de 2019, 4:34:14 (UTC-4), Andrea Marchesini escribió:

kolony...@gmail.com

non lue,
5 mars 2020, 15:45:1705/03/2020
à
23 Mayıs 2019 Perşembe 11:34:14 UTC+3 tarihinde Andrea Marchesini yazdı:

yucaga...@gmail.com

non lue,
6 mars 2020, 13:42:4006/03/2020
à
eae galera
n tirem meu google de mim
porfavor

gabim...@gmail.com

non lue,
9 mars 2020, 14:01:1009/03/2020
à
בתאריך יום חמישי, 23 במאי 2019 בשעה 11:34:14 UTC+3, מאת Andrea Marchesini:

thale...@gmail.com

non lue,
11 mars 2020, 20:03:2711/03/2020
à
oooooooo aai mi pklasereeeee
3wwre33gtr
h23tytgm

gard...@gmail.com

non lue,
31 mars 2020, 07:53:1031/03/2020
à
On Thursday, May 23, 2019 at 4:34:14 AM UTC-4, Andrea Marchesini wrote:
who do we blame this one on ladies no one wants the truth for some reason

kyle.bl...@gmail.com

non lue,
31 mars 2020, 14:38:5031/03/2020
à

bb08...@gmail.com

non lue,
7 avr. 2020, 23:10:4607/04/2020
à
Add me. Hhhh