5 ms·

I believe originally (back in the early drafts of the spec) the concept of a "site" was significantly stricter (based on the origins matching), but it got water

by lol768 5y ago

I believe originally (back in the early drafts of the spec) the concept of a "site" was significantly stricter (based on the origins matching), but it got watered down which was a real shame. I'm not sure why. c.f. https://tools.ietf.org/html/draft-west-first-party-cookies-02 https://tools.ietf.org/html/draft-west-first-party-cookies-0... and https://tools.ietf.org/html/draft-west-first-party-cookies-03 https://tools.ietf.org/html/draft-west-first-party-cookies-0... Excerpts (draft 2): > If "document" is a first-party context, and "request"'s URI's origin is the same as the origin of the URI of the active document in the top-level browsing context of "document", then return "First-Party". vs. (draft 3) > A document is considered a "first-party context" if and only if the registerable domain of the origin of its URI is the same as the registerable domain of the first-party origin, and if each of the active documents in its ancestors' browsing contexts' is a first-party context.

hsbauauvhabzb 5y ago
Any good references on the definition? I’ve always found it awkward.
- bugmen0t 5y ago
  The concept of a Site is defined here https://html.spec.whatwg.org/multipage/origin.html#sites https://html.spec.whatwg.org/multipage/origin.html#sites It's basically an origin, but disregarding subdomains.
tehbeard 5y ago
> but it got watered down which was a real shame. I'm not sure why. I think (and this might just be an old wive's tale) it was related to the browser connection limits being per domain, and so subdomains + looser cookie origins was a band aid for it.