RFC 6265bis compliance for the cookie implementation

[arturobernalg]

Enforces the __Secure- and __Host- cookie name prefixes, adds the SameSite attribute with the SameSite=None requires Secure rule, includes the host-only flag in cookie identity, applies the 4096-byte cookie and 1024-byte attribute size limits and the 400-day maximum lifetime, supports nameless cookies in both parsing and serialization, and prevents a non-secure connection from overwriting a stored secure cookie.

[ok2c]

@arturobernalg RFC 6265bis is still a draft, it is not? What is so important about this feature that we need to rush it and implement a draft RFC which has not been accepted as standard yet?

[arturobernalg]

@arturobernalg RFC 6265bis is still a draft, it is not? What is so important about this feature that we need to rush it and implement a draft RFC which has not been accepted as standard yet?

@ok2c
You're right, it's still a draft — but the __Host-/__Secure- prefix and SameSite bits it covers are already universal, interoperable browser behaviour, and the prefix checks are a real acceptance/security gap in our cookie store today. Happy to scope it to just those stable parts and mark it @experimental, or hold it until 6265bis is published

[ok2c]

@arturobernalg I honestly have no idea how much those new attributes are being used / relied upon in everyday life. I have an impression HTTP cookies are getting used less and less. I was even going to propose to disable automatic cookie handling by default.

Anyway, I leave it up to you to make a call here. If you resolve the conflicts I will take another look at the parsing code.