bk99.de entertain the web since 1997

bk99.de
RFC · WebStandard explained

RFC 6265: HTTP cookies: State on the web

Summary

RFC 6265 unifies cookie syntax and browser behaviour for session-related state over HTTP. Automatically attached state makes applications easier and increases CSRF and tracking risks. Secure defaults matter more than policies added later.

Ideas

  • Servers set name-value pairs with a scope.
  • Browsers automatically send matching cookies back.
  • Secure, HttpOnly and SameSite limit different risks.

Facts

  • RFC 6265 replaces RFC 2965.

Remarks

  • RFC 6265 has the status “Proposed Standard”; current errata and successor documents should also be checked.

Recommendations

  • Set Secure, HttpOnly and a restrictive SameSite.
  • Keep lifetime and domain scope as small as possible.

References

Read the RFC at the RFC Editor

Search the Web Archive

RFC · 2026

RFC 10008: HTTP QUERY: Safe, idempotent queries with content

RFC 10008 defines the HTTP method QUERY for complex, safe and idempotent queries with request content. New methods close gaps when established semantics do not fit cleanly. Explicit semantics are better than misused POST requests.

RFC · 2022

RFC 9110: HTTP semantics reorganised

RFC 9110 defines the shared semantics of HTTP independently of the concrete transport versions. Separate semantics allow HTTP/1.1, HTTP/2 and HTTP/3 to share a common basis. Clear terms reduce contradictory implementations.

RFC · 2022

RFC 9114: HTTP/3 over QUIC

RFC 9114 maps HTTP semantics onto QUIC and avoids TCP-induced blocking between independent streams. HTTP/3 ties application and transport development more closely together than earlier versions. UDP reachability becomes an important operational factor again.