{"action":"created","issue":{"url":"https://api.github.com/repos/httpwg/http-extensions/issues/226","repository_url":"https://api.github.com/repos/httpwg/http-extensions","labels_url":"https://api.github.com/repos/httpwg/http-extensions/issues/226/labels{/name}","comments_url":"https://api.github.com/repos/httpwg/http-extensions/issues/226/comments","events_url":"https://api.github.com/repos/httpwg/http-extensions/issues/226/events","html_url":"https://github.com/httpwg/http-extensions/issues/226","id":171237075,"number":226,"title":"Lax same-site cookies should allow <a target=\"_blank\">","user":{"login":"jakearchibald","id":93594,"avatar_url":"https://avatars.githubusercontent.com/u/93594?v=3","gravatar_id":"","url":"https://api.github.com/users/jakearchibald","html_url":"https://github.com/jakearchibald","followers_url":"https://api.github.com/users/jakearchibald/followers","following_url":"https://api.github.com/users/jakearchibald/following{/other_user}","gists_url":"https://api.github.com/users/jakearchibald/gists{/gist_id}","starred_url":"https://api.github.com/users/jakearchibald/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jakearchibald/subscriptions","organizations_url":"https://api.github.com/users/jakearchibald/orgs","repos_url":"https://api.github.com/users/jakearchibald/repos","events_url":"https://api.github.com/users/jakearchibald/events{/privacy}","received_events_url":"https://api.github.com/users/jakearchibald/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"mikewest","id":1497,"avatar_url":"https://avatars.githubusercontent.com/u/1497?v=3","gravatar_id":"","url":"https://api.github.com/users/mikewest","html_url":"https://github.com/mikewest","followers_url":"https://api.github.com/users/mikewest/followers","following_url":"https://api.github.com/users/mikewest/following{/other_user}","gists_url":"https://api.github.com/users/mikewest/gists{/gist_id}","starred_url":"https://api.github.com/users/mikewest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikewest/subscriptions","organizations_url":"https://api.github.com/users/mikewest/orgs","repos_url":"https://api.github.com/users/mikewest/repos","events_url":"https://api.github.com/users/mikewest/events{/privacy}","received_events_url":"https://api.github.com/users/mikewest/received_events","type":"User","site_admin":false},"assignees":[{"login":"mikewest","id":1497,"avatar_url":"https://avatars.githubusercontent.com/u/1497?v=3","gravatar_id":"","url":"https://api.github.com/users/mikewest","html_url":"https://github.com/mikewest","followers_url":"https://api.github.com/users/mikewest/followers","following_url":"https://api.github.com/users/mikewest/following{/other_user}","gists_url":"https://api.github.com/users/mikewest/gists{/gist_id}","starred_url":"https://api.github.com/users/mikewest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikewest/subscriptions","organizations_url":"https://api.github.com/users/mikewest/orgs","repos_url":"https://api.github.com/users/mikewest/repos","events_url":"https://api.github.com/users/mikewest/events{/privacy}","received_events_url":"https://api.github.com/users/mikewest/received_events","type":"User","site_admin":false}],"milestone":null,"comments":3,"created_at":"2016-08-15T18:59:37Z","updated_at":"2016-08-16T11:00:09Z","closed_at":null,"body":"Unless I'm misreading the spec, it seems like lax same-site cookies will only be sent for top-level browsing contexts. `<a href=\"…\" target=\"_blank\">` creates an auxiliary context.\r\n\r\nAs far as I know, the initiator doesn't get any additional information from a `_blank` link, so this restriction seems unnecessary.\r\n\r\n+@mikewest "},"comment":{"url":"https://api.github.com/repos/httpwg/http-extensions/issues/comments/240070949","html_url":"https://github.com/httpwg/http-extensions/issues/226#issuecomment-240070949","issue_url":"https://api.github.com/repos/httpwg/http-extensions/issues/226","id":240070949,"user":{"login":"mikewest","id":1497,"avatar_url":"https://avatars.githubusercontent.com/u/1497?v=3","gravatar_id":"","url":"https://api.github.com/users/mikewest","html_url":"https://github.com/mikewest","followers_url":"https://api.github.com/users/mikewest/followers","following_url":"https://api.github.com/users/mikewest/following{/other_user}","gists_url":"https://api.github.com/users/mikewest/gists{/gist_id}","starred_url":"https://api.github.com/users/mikewest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikewest/subscriptions","organizations_url":"https://api.github.com/users/mikewest/orgs","repos_url":"https://api.github.com/users/mikewest/repos","events_url":"https://api.github.com/users/mikewest/events{/privacy}","received_events_url":"https://api.github.com/users/mikewest/received_events","type":"User","site_admin":false},"created_at":"2016-08-16T11:00:09Z","updated_at":"2016-08-16T11:00:09Z","body":"> That means lax cookies will be sent on a window.open load, which will leak some timing through the window proxy. It's it worth tweaking to avoid that?\r\n\r\nUse `SameSite=strict`? I'm not sure I see the value of complicating this even further with `Lax`, `SomewhatLessLax`, and `Strict`.\r\n\r\nWhat timing detail leaks through `window.open`? I'm not familiar enough with the various holes we've bored into things at this point...\r\n\r\n> I'm looking for ways to allow cookies on top level navigations unless another origin has access to the window proxy (window.open, iframes).\r\n\r\n`Lax` takes care of the latter, as I'm sure you're aware."}}
{"actor":{"display_login":"mikewest"}}