Re:Total Cookie Protection
by andrewmcwatters on Wednesday February 24, 2021 @04:32PM
(#26256317)
My point is you can make these arguments all day. Why do we allow iframes? You could argue web servers should simply communicate among themselves and serve subdocuments to clients.
Why is HTTP/2 Server Push being rescinded?
Why do user agents not provide additional types for <script> based on runtime installations?
Why isn't there a renderer API that allows me to use painted trees in <canvas>, but there is a bluetooth API that no one uses?
I am not sure if I get your point then. I think it is important to see the patterns of bad decisions in the past to improve decision making in the future.
That those mistakes were not done deliberately and with good intentions is a completely different story and that in hindsight everything looks so clear is also well known ;-)
I think the whole idea of sharing cookies across origins was a conceptual mistake right from the beginning, because it is also responsible for quite a lot of security vectors which had to be fixed by other mechanics like the SOP (Same Origin Policy) which in turn required mechanics like CORS (Cross Origin Resource Sharing).
And with all those mechanics in place, modern browsers are pretty tied up and are significantly reduced in their abilities compared to other HTTP/S clients. So when you want to build a PWA (Progressive Web App) that can use a configurable backend (as in federated), you will run into all kinds if problems, that can all be traced back to the decision to share cookies across origins.