16739 2012-04-13 22:28:18 +0000 Should the format of Session ID be more strictly defined? 2012-12-07 01:25:49 +0000 1 1 1 Unclassified HTML WG Encrypted Media Extensions unspecified All All RESOLVED FIXED P3 normal --- 1 ddorwin watsonm eric.carlson mike petr philipj public-html-media public-html-wg-issue-tracking scherkus public-html-bugzilla oldest_to_newest 66715 0 ddorwin 2012-04-13 22:28:18 +0000 v0.1 does not give much guidance on the format of Session ID strings. [1] Should the format of Session ID be more strictly defined or is anything other than null and "" valid? Would restricting allowed formats make application and server implementation easier? Possible items for discussion: * Does the string need to represent a number? If so must it be positive, decimal/hex, etc.? * When may IDs be reused, if at all? * Must values increase or can they be random? * How unique must they be? Per page? Per renderer? Across the system? [1] http://dvcs.w3.org/hg/html-media/raw-file/tip/encrypted-media/encrypted-media.html#session-id 72932 1 adrianba 2012-08-28 21:18:34 +0000 Assigning to Mark. We should enforce greater uniqueness for systems that support key release. Mark will also investigate if any other restrictions are useful beyond key release. 74555 2 watsonm 2012-09-26 16:10:48 +0000 I suggest we place no requirements on the SessionID other than that it must be unique within the browsing session (right term ?). If proof of key release is supported we add the additional requirement that it be unique for this browser instance. This is the wrong term, but what I mean is the same thing that owns Local Storage, say. An application could then create a globally unique session Id by storing a unique 'browser instance id' in Location Storage and combining this with the session id. Anyone know the correct term ?. 77306 3 watsonm 2012-10-29 16:51:16 +0000 I believe the correct terms would be "browsing context" if secure proof of key release is not supported or "origin" if it is. Proposal: add the following text to Section 1.2.3: "Each SessionID shall be unique within the browsing context in which it was created. If secure proof of key release is supported each Session ID shall be unique within the origin. Note that this last requirement implies that Session IDs shall be unique over time including across browsing sessions." 79588 4 watsonm 2012-12-07 00:01:48 +0000 http://dvcs.w3.org/hg/html-media/rev/96098ab59a59