w3c/network-error-logging

`request_headers` may send SameSite cookies cross-site

Opened this issue · 2 comments

chlily1 commented

If a NEL policy requests Cookie headers be sent in the request_headers report field, then SameSite cookies may be sent cross-site to a report collector.

clelland commented

Discussed at TPAC, and the sentiment in the room was that we perhaps should simply not send cookies in reports.
(Also see #112)

  • 👍1
yoavweiss commented

Beyond that, NEL collectors in the room are currently actively stripping that information and have no use-case for it. So there's no apparent trade-off in simply removing headers from the reports.