During Heather's REFEDs presentation, Scott Cantor suggested a new attribute be added to the set cookie header to signal that the cookie MUST be deleted on browser close as well as any other time the browser considers the session over.

These notes are to communicate a proposed change to https://datatracker.ietf.org/doc/draft-ietf-httpbis-rfc6265bis/ via a github issue at https://github.com/httpwg/http-extensions/labels/6265bis and some email to mailing list https://lists.w3.org/Archives/Public/ietf-http-wg/

I’m happy to work more on this, but to do so I need some people to thresh out whether UserSession is the right name and at least one person to read drafts and improve the technical content  and at least one person (who may be the same) to read drafts – Scott said he'd do that –  and edit the grammar and spelling and word choice and run on sentences.   I can coordinate meetings on the topic, but if Heather would like to help open this to REFEDs and so on, I would WELCOME it.

Me to Everyone (1:45 PM)
Heather — do you want to convene or communicate a Scott’s cookie attribute group?
Heather Flanagan to Everyone (1:45 PM)
I want to take that one.
Heather Flanagan to Everyone (1:46 PM)
I was on a call yesterday about how Google, at least, would accept that work, so I am probably best positioned to move it forward.
Me to Everyone (1:48 PM)
I’ve started drafting what has been discussed in the email at https://spaces.at.internet2.edu/display/inctac/Session+Cookie+Suggestion
Should i move it to my own GitHub or?
Heather Flanagan to Everyone (1:49 PM)
GitHub or collaborative google doc, whatever you prefer
Johnny Lasker to Everyone (1:59 PM)
Good conversation, I need to jump to my next call. Take care.


[1] H. Flanagan, T. Cappalli, and S. Goto, “Update on Google’s Web Tracking Initiative,” OpenID Foundation Virtual Workshop, 29-Apr-2021.


  • No labels