Backwards compatability, cookies, and consent

[robrwo]

The way session handling in most websites work is through cookies.

1. User-agent (UA) sends request to website
2. Web server (WS) sends cookie with response
3. UA accepts cookie
4. UA returns cookie in next request.
5. WS validates cookie as being in same session as no. 1

See also some discussion in #11, particular the assumption that the web server will not send a cookie until it receives consent in an ADC header, something like
6. UA passes ADPC consent request to user and receives permission to use cookies
7. UA includes ADC headers giving consent
8. WS responds with a cookie

The problem is that user agents which do not support ADPC will never issue consent (7), so websites that require cookies for some purposes will not work with older user agents.

I think the workaround for this is for web servers to not send cookies if they request has a "ADC: withdraw=*" header but send cookies if the the request consents to it. User agents would pass a withdraw header the first time they connect to a webserver.

[michael-oneill]

They would not have to place cookies even if the ADPC is not present (because ePrivacy)

[robrwo]

They would not have to place cookies even if the ADPC is not present (because ePrivacy)

Who is "they"? The User-Agent? The web server?

[michael-oneill]

Sorry, I was too terse. I meant the web server (or the browser context of the web server). Only cookies that are solely required for the underlying communications, or those strictly necessary to fulfil a user request, can be placed on first HTTP request. The url might signal a user request in some circumstances, and there may be a requirement for a cookie to help load ballancing (though I have never seen one), but every other case there should be nothing in the Set-Cookie header.

[robrwo]

Only cookies that are solely required for the underlying communications, or those strictly necessary to fulfil a user request, can be placed on first HTTP request.

That's what I am talking about.

[gb-noyb]

The problem is that user agents which do not support ADPC will never issue consent (7), so websites that require cookies for some purposes will not work with older user agents.

As discussed in #11, if websites “require cookies for some purposes”, they either do not need to ask for consent, or they need to ask consent whether or not the user agent supports ADPC. For older user agents (not supporting ADPC), websites could fall back to using a classical consent request (‘cookie banner’). As Mike said, this makes no difference for the first request and response. Does this resolve the issue?