Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove consideration of same-site redirect chain #2750

Merged
merged 5 commits into from
Mar 18, 2024
+5 −6
Merged

Remove consideration of same-site redirect chain #2750

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
fb0797e
Remove consideration of redirect chain
sbingler Mar 6, 2024
2b005d8
Fix header
sbingler Mar 6, 2024
7f484f6
Remove angled brackets
sbingler Mar 7, 2024
29e3eda
Add PR link
sbingler Mar 7, 2024
2b45cc8
Merge branch 'main' into RemoveSamesiteRedirect
sbingler Mar 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 5 additions & 6 deletions draft-ietf-httpbis-rfc6265bis.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1059,15 +1059,11 @@ following conditions holds:
Two origins are same-site if they satisfy the "same site" criteria defined in
{{SAMESITE}}. A request is "same-site" if the following criteria are true:

1. The request is not the result of a cross-site redirect. That is,
the origin of every url in the request's url list is same-site with the
request's current url's origin.

2. The request is not the result of a reload navigation triggered through a
1. The request is not the result of a reload navigation triggered through a
user interface element (as defined by the user agent; e.g., a request
triggered by the user clicking a refresh button on a toolbar).

3. The request's current url's origin is same-site with the request's
2. The request's current url's origin is same-site with the request's
client's "site for cookies" (which is an origin), or if the request has no
client or the request's client is null.

Expand Down Expand Up @@ -2720,6 +2716,9 @@ The "Cookie Attribute Registry" should be created with the registrations below:
* Add additional developer warnings for SameSite cookies
<https://github.com/httpwg/http-extensions/pull/2758>

* Remove consideration of same-site redirect chain
<https://github.com/httpwg/http-extensions/pull/2750>

# Acknowledgements
{:numbered="false"}
RFC 6265 was written by Adam Barth. This document is an update of RFC 6265,
Expand Down
Loading