Cookies: `__Secure-`/`__Host-` prefixes about http-observatory

[tobijdc]

👋

I have recently learned about cookie prefixes and their usefulness.
I was surprised observatory did not check them.
It seems that Safari (at least recently) also supports these prefixes.

Is there interest for giving a small bonus score, if cookies additionally use these prefixes?
I am not a python developer, but I could give this a try over the Holidays, if there would be a willingness to merge this.

References:
Mozilla Infosec Guidelines, not marked experimental anymore like in the Mozilla wiki
MDM1
MDM2

[april]

Yep, they were on the docket, but there had been so many changes to the spec that I wanted to wait until it was a bit more set in stone. But the eventual plan is to give +5 for using these prefixes. :)

[craigfrancis]

Good point, the prefix was recently changed (Nov 2015) to use double underscores (rather than a dollar sign, which caused a couple of problems).

But as far as I can tell, this is the final version (and is implemented in Google Chrome).

Further discussion at:

https://twitter.com/tbroyer/status/670779401135616000

[april]

Note that our own guidelines talk about this:

https://wiki.mozilla.org/User:Apking/Web_Security_Guidelines#Cookies

Are you aware if anybody besides Chrome has implemented this yet?

[craigfrancis]

Not yet, but I have created feature requests for Safari and IE:

https://bugs.webkit.org/show_bug.cgi?id=158730

https://wpdev.uservoice.com/forums/257854-microsoft-edge-developer/suggestions/14807901-add-secure-and-host-cookie-prefix-suppor

[rugk]

Actually the prefix is still ugly as the - causes problems.
So personally I hope the standard changes again...