Since first-party cookies are used to track login state, you do want someway to opt into sharing them site wide for sites where forum.example.com and mail.example.com have the same concept of a user.
For this, a list of TLDs which it would be invalid to specify as the domain would cover most cases.
That is what the public suffix list is?
some additional DNS property they set which makes it invalid to have a cookie at that domain level
The problem with his approach is that registries would need to opt in, but in some cases registries can’t be bothered and, since it’s a security matter, the PSL maintainers (Mozilla) do it for them.
Since first-party cookies are used to track login state, you do want someway to opt into sharing them site wide for sites where
forum.example.comandmail.example.comhave the same concept of a user.That is what the public suffix list is?
The problem with his approach is that registries would need to opt in, but in some cases registries can’t be bothered and, since it’s a security matter, the PSL maintainers (Mozilla) do it for them.