<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Picking up from my idea:<br>
<br>
<div class="moz-cite-prefix">On 08-09-2015 08:08, Brunoais wrote:</div>
<blockquote cite="mid:55EE8965.9070207@gmail.com" type="cite"> Why
not allow the website telling a "tracking cookie" that, when it
expires, all related data "linked" to that cookie is also deleted?<br>
Even if it is limited to cached resources, it should be useful
enough.<br>
Personally, I'd like to send the user something of sorts:<br>
<br>
Cache-Cookies: (jSessionid OR PHPSESSIONID)<br>
Cache-Cookie-Expire-Remove: *.php *.jsp */*/ */*-*<br>
<br>
That would mean:<br>
Track 2 cookies. 1 is named jSessionid and the other PHPSESSIONID.<br>
If either expire, remove all cached content on pages whose url
matches any of:<br>
<ul>
<li>.*php -> php file</li>
<li>*.jsp -> jsp files</li>
<li>*/*/ -> All URL that are paths (the ending "/" makes it
not match files)</li>
<li>*/*-* -> All url with paths that contain an "-"</li>
</ul>
<p><br>
Besides the OR above, I think that an AND should also be valid.</p>
<p>If "Cache-Cookies:" is defined, "Cache-Cookie-Expire-Remove:"
defaults to "*" I.e. everything.<br>
</p>
<p><b>Consequence:</b> If the server sends those headers such that
it tracks a cookie that expires on that request (past date on
the expires field), then the effects take effect immediately
after the request.<br>
</p>
<p><br>
This is just a <b>proposal</b>
. It has <b>many design problems</b> but I think it is a nice
stepping stone to start an idea.<br>
</p>
</blockquote>
<br>
Then it would be quite cool if, instead of using
"Cache-Cookie-Expire-Remove", you'd, instead, only send the
"Cache-Cookies" header on the requests you don't want cached beyond
the lifetime of the cookies according to the boolean expression.
With that, it is applied and associated to the specific resource
instead of the resources from a certain origin.<br>
Opinions pls!<br>
<br>
<div class="moz-cite-prefix">On 08-09-2015 09:12, Gervase Markham
wrote:<br>
</div>
<blockquote cite="mid:55EE9858.1080002@mozilla.org" type="cite">
<pre wrap="">On 08/09/15 00:19, Bram Pitoyo wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Instead of a per-site caching rule, we’d like to have it so that a site
can say to any browser: “Please always open me in Private Browsing”, and
the browser would respect that.
</pre>
</blockquote>
<pre wrap="">
That might work for some use cases. The use case I had in mind was
Bugzilla, where there are some secure bugs, but lots of non-secure ones.
Ideally, on logout or after a time expiry, the secure bugs would be
deleted from the cache, but the other information could stay.
Perhaps you could add this use case to your collection, even if you
decide to rule it out of scope?
</pre>
<blockquote type="cite">
<pre wrap="">Do we have a similar goal? Can we collaborate? Francois and Javaun are
CCed on this email, and they can chime in.
</pre>
</blockquote>
<pre wrap="">
I just have ideas; other people are much more qualified than I to
actually make them happen :-)
Gerv
_______________________________________________
firefox-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:firefox-dev@mozilla.org">firefox-dev@mozilla.org</a>
<a class="moz-txt-link-freetext" href="https://mail.mozilla.org/listinfo/firefox-dev">https://mail.mozilla.org/listinfo/firefox-dev</a>
</pre>
</blockquote>
<br>
</body>
</html>