TODO: Leave secure cookies alone

diff --git a/docs/TODO b/docs/TODO
index 1695d559c3d297d3c881c330f21365d67aa39cf3..24bbcd208fee74b94f8f0f309f5418abc0d86a6a 100644 (file)
--- a/docs/TODO
+++ b/docs/TODO
@@ -69,6 +69,7 @@
  5.7 Brotli compression
  5.8 QUIC
  5.9 Add easy argument to formpost functions
+ 5.10 Leave secure cookies alone
 
  6. TELNET
  6.1 ditch stdin
@@ -554,6 +555,14 @@ This is not detailed in any FTP specification.
  deprecating the old ones. Allows better error messages and is generally good
  API hygiene.
 
+5.10 Leave secure cookies alone
+
+ Non-secure origins (HTTP sites) should not be allowed to set or modify
+ cookies with the 'secure' property:
+
+ https://tools.ietf.org/html/draft-ietf-httpbis-cookie-alone-01
+
+
 6. TELNET
 
 6.1 ditch stdin