Re: First-Party-Only cookies

On Wed, Jan 20, 2016 at 11:30 PM, Martin Thomson <[email protected]> wrote:

> Wouldn't it be possible to use the first-party cookie in those cases
> at the cost of one extra request?
>

Sure. That seems like a large cost, but it's certainly one we could ask
folks to pay.


> The third-party initiated, top-level load would have no first-party
> cookies, but that page could initiate a new request to check
> credentials, which would have the first-party cookie.
>

How would you know when to do this? You'd have to do it for basically every
incoming request, right?


> It's a little extra latency, but it would seem to retain the
> properties we're looking for.


For some value of "little" that might not actually be little.


> For simplicity, a same-origin redirect
> might be permitted to gain access to first-party cookies.
>

My suspicion is that the general flow would be something like this:

* User gets an email with a link to `github.com/sekrit/project/pull/1`
* User clicks on the link.
* GitHub returns a 404 because it doesn't want to leak the fact that the
project exists to folks who shouldn't be able to see it.
* User is sad.

Your suggestion is that the 404 page could be a 302 instead? To itself?

-mike