search

w3c / webappsec-suborigins

Suborigins
https://w3c.github.io/webappsec-suborigins/
Other
25 stars 9 forks source link

<meta http-equiv="Set-Cookie" content="..."> should be ignored #36

Closed bsittler closed 8 years ago

bsittler commented 8 years ago

<meta http-equiv="Set-Cookie" content="..."> should be ignored in any suborigin where document.cookie writes are ignored or fail

joelweinberger commented 8 years ago

As discussed in #56, it actually seems like the HTML spec should be changed to reflect that cookie-averse documents should disallow http-equiv=Set-Cookie, so I've filed https://github.com/whatwg/html/issues/1950 to suggest that. However, I'm still planning on committing #56 in the meantime to make sure our spec tracks this.

joelweinberger commented 8 years ago

This is addressed as of #56.