@@ -225,10 +225,9 @@ informative:
225225This document defines the HTTP Cookie and Set-Cookie header fields. These
226226header fields can be used by HTTP servers to store state (called cookies) at
227227HTTP user agents, letting the servers maintain a stateful session over the
228- mostly stateless HTTP protocol. Although cookies have many historical
229- infelicities that degrade their security and privacy, the Cookie and Set-Cookie
230- header fields are widely used on the Internet. This document obsoletes RFC
231- 6265.
228+ mostly stateless HTTP protocol. Although cookies have many historical flaws
229+ that degrade their security and privacy, the Cookie and Set-Cookie header
230+ fields are widely used on the Internet. This document obsoletes RFC 6265.
232231
233232--- middle
234233
@@ -247,12 +246,12 @@ user agent. The scope indicates the maximum amount of time in which the user
247246agent should return the cookie, the servers to which the user agent should
248247return the cookie, and the connection types for which the cookie is applicable.
249248
250- For historical reasons, cookies contain a number of security and privacy
251- infelicities. For example, a server can indicate that a given cookie is
252- intended for "secure" connections, but the Secure attribute does not provide
253- integrity in the presence of an active network attacker. Similarly, cookies
254- for a given host are shared across all the ports on that host, even though the
255- usual "same-origin policy" used by web browsers isolates content retrieved via
249+ For historical reasons, cookies contain a number of security and privacy flaws.
250+ For example, a server can indicate that a given cookie is intended for "secure"
251+ connections, but the Secure attribute does not provide integrity in the
252+ presence of an active network attacker. Similarly, cookies for a given host
253+ are shared across all the ports on that host, even though the usual
254+ " same-origin policy" used by web browsers isolates content retrieved via
256255different ports.
257256
258257This specification applies to developers of both cookie-producing servers and
0 commit comments