Design Review #297

#297: HTTP State Tokens

Visit on Github.

Opened Aug 14, 2018

Guten TAG,

I'm requesting a TAG review of:

Name: HTTP State Tokens
Specification URL: N/A
Explainer, Requirements Doc, or Example code: https://github.com/mikewest/http-state-tokens
Tests: N/A
Primary contacts: @mikewest

Further details (optional):

Relevant time constraints or deadlines: None. This is a super-sketchy idea that's just baked enough to ask people to start poking at it with toothpicks to see how runny it is inside.
I have read and filled out the Self-Review Questionnare on Security and Privacy. The assessment is here.
I have reviewed the TAG's API Design Principles

You should also know that...

I'm only sending this to y'all at this point because I alluded to it in our last meeting. I'd appreciate y'all's feedback, but this isn't something folks have solidly bought into yet, and there's no risk of it shipping (or being implemented) anytime soon. It's a thought experiment I'd like y'all to participate in, which hopefully will lead to a reasonable design in the future.

We'd prefer the TAG provide feedback as (please select one):

open issues in our Github repo for each point of feedback
open a single issue in our Github repo for the entire review
leave review feedback as a comment in this issue and @-notify [github usernames]

Discussions

2018-11-28

Minutes

hadley: looks like we are discussing tangents .. mike has said 28 days ago that it will be more clear when he writes a spec. suggest we close it and say "great, see you then."

Dan: I agree.

Hadley: I will close

2020-01-27

Minutes

Yves: the issue is that it's a high cost to replace cookies with something new. It might be better for incremental changes to cookies achive that goal. I don't think just changing to http state tokens would be easy because of all of the different paerts of the [the ecosystem] which rely on cookies.

Yves: we did discuss this feedback previously. Not a new thing. So - should we review technical points on the latest spec or close it because we're waiting for a clear upgrading path from cookies...

Dan: should we provide some clear TAG feedback that we would like to see this couched as an incremental upgrade from cookies rather than a replacement - like what is the gradual approach?

Yves: there are experiments ongoing on cookies - lifetime, etc...

Dan: it would be good to understand the outcomes of those experiments.

Yves: not sure replacing cookies with soemthiing new will help - people will find other ways to track.

Dan: I feel like we should aim to close this issue with some definitive feedback at our f2f.

2020-02-10

Minutes

(reading issue to try to figure out what the state of it is)

Yves: maybe try asking Mike to figure out what the plans in this space (including for cookies) are? Get clarification on upgrade path? Perhaps we should ask the chairs if we want to try to make further progress on the issue -- we can discuss that in the plenary