Subject: Re: Last Call: Applicability Statement for HTTP State Management to BCP

From: Jacob Palme <[email-masked]>
Date: Mon, 16 Aug 1999 20:39:23 +0200

draft-iesg-http-cookies-00.txt says that cookies are allowed for 
maintaining sessions, but not in general for authentication. But 
there is no sharp border between maintaining sessions and 
authentication.

If a user makes a series of rapid interactions with the same server, 
this is clearly a session. If a user connects one week later to the 
same server, use of a cookie from the previous week is probably 
authentication. But what if a user visits some other web pages during 
a session. How long or what kind of break in a session means that 
cookies should not be used? Should the IESG proposal mean that 
cookies should be deleted whenever a user restarts his web browser or 
computer?

One way of handling this might be to ask the user which validity
time the user wants for the cookie. Depending on whether the
computer is used by more than one person, and how easy it is
to get into the room, and how secret the info is, and which
privacy requirements the user has, the user could select a
suitable Max-age.
------------------------------------------------------------------------
Jacob Palme <[email-masked]> (Stockholm University and KTH)
for more info see URL: http://www.dsv.su.se/~jpalme