Cookie Specification

The HTTP Working Group of the Internet Engineering Task Force (IETF) is in the process of standardizing what are often referred to as (Netscape) ``cookies.'' Cookies are a way for a server to sustain a stateful session by passing information back to a user agent; the user agent returns the information back to the server on its next visit.

Specification Status

RFC 2965 specifies the HTTP State Management Mechanism and is a Proposed Standard. RFC 2965 supersedes RFC 2109.

BCP 44, RFC 2964, Use of HTTP State Management, is an important adjunct to the cookie specification itself.

Official discussions of the cookie specifications occur on the HTTP-WG mailing list, but some more general discussions of HTTP State Management occur on the http-state mailing list.

Errata to RFC 2965

Discussions of errata to RFC 2965 are held on the revised HTTP State mailing list. This page tracks the issues under discussion.

Proxy Cookies

Work has begun to specify proxy cookies, which would maintain state between a proxy server and its nearest client.

More Information

You can examine the evolution of RFC 2965. Cookie Central has quite a collection of information about cookies. And there's another nice resource page with general information about cookies, including privacy. The Computer Incident Advisory Capability (CIAC) folks have posted a pretty good description of the risks of cookies from a computer intrusion standpoint. Finally, there's the book, ``cookies,'' by Simon St. Laurent, which discusses cookies, cookie applications, and the privacy aspects of cookies. McGraw-Hill. ISBN 0-07-050498-9.

I have written a paper, HTTP Cookies: Standards, Privacy, and Politics, which should be published during 2001 in an ACM journal. Here's the abstract:

How did we get from a world where cookies were something you ate and where ``non-techies'' were unaware of ``Netscape cookies'' to a world where cookies are a hot-button privacy issue for many computer users? This paper will describe how HTTP ``cookies'' work, and how Netscape's original specification evolved into an IETF Proposed Standard. I will also offer a personal perspective on how what began as a straightforward technical specification turned into a political flashpoint when it tried to address non-technical issues such as privacy.

Rajiv Shah is preparing a case study on cookies. Meanwhile, he has prepared a comprehensive list of links of background and technical information about cookies.

Netscape's ``Preliminary Specification'' for Persistent Client State HTTP Cookies.

For reference purposes, my original State-Info proposal, Proposed HTTP State-Info Mechanism (1995): [text]   [Postscript]

David M. Kristol,
Last modified: March 28, 2006