Cookie layering - Http prefix

[yoavweiss]

As discussed at IETF 122, this is a stab at integrating https://yoavweiss.github.io/httponly_prefix/draft-httponlyprefix-weiss-http.html with the Cookie layering processing model.

---

• Cookie Store API PR: __Http prefix WICG/cookie-store#262
• WPT coverage: https://chromium-review.googlesource.com/c/chromium/src/+/6638647/12/third_party/blink/web_tests/external/wpt/cookies/prefix/__Http.https.html

[yoavweiss]

Given https://lists.w3.org/Archives/Public/ietf-http-wg/2025AprJun/0188.html, maybe we want to land __HttpOnly first while we figure out what the compounding mechanism here should be?

[annevk]

It might be good to open an issue to discuss further, but my inclination would be that we turn this into some kind of table of prefix strings and their corresponding restrictions down the line. I don't think the combinatorial explosion is all that bad and allowing them in arbitrary order would in fact turn a simple prefix match into a parser question with all the resulting issues that come with that.

[yoavweiss]

Yeah, there's a discussion happening on that front in https://lists.w3.org/Archives/Public/ietf-http-wg/2025AprJun/0192.html

I think we can split this into two separate things:

1. Add an HttpOnly (or Http) prefix
2. Figure out a way to combine multiple prefixes

If that makes sense, I'm happy to turn this into (1) and open an issue to further discuss (2)

[annevk]

Unfortunately this will also need a corresponding PR to the Cookie Store API. Perhaps if we eventually abstract this convention somehow we can improve that.

[annevk]

I like the idea of the prefix being just Http for brevity's sake. I also think we should have an issue for the multiple discussion as it'll come back.

[yoavweiss]

I like the idea of the prefix being just Http for brevity's sake. I also think we should have an issue for the multiple discussion as it'll come back.

Revamped this PR to just handle the Http prefix, and opened #3111 for further discussion on prefix combinatorics.

[annevk]

I added a checklist to OP for what remains to be done. I suppose we also need to make some assessment as to whether this has broad enough support, but I think it has from the list discussion.

[yoavweiss]

@annevk - I tried to split out the conditions to separate algorithms, to make it easier/clearer when combining them for HostHttp. Let me know what you think.

[annevk]

I like it. I'm half-tempted to also suggest introducing a list of known prefixes so we can deduplicate some of that across specifications, but I think this is sufficient for now. At some point the abstractions might also impede clarity.