Does DACS require that HTTP cookies be used?
No. The requirement for a common domain name suffix for jurisdictions is due to the rules that standard browsers use to decide whether to send an HTTP cookie. Since DACS is often deployed in environments where these off-the-shelf browsers are used, HTTP cookies are the mechanism of choice to convey DACS identities. Using cookies to store authentication state (credentials) is primarily a convenience and efficiency measure, so they are important even in a single jurisdiction federation. The use of HTTP cookies and common domain name suffixes is not integral to the system architecture, however. In environments less general or with different requirements than what DACS was designed for, alternatives to HTTP cookies may be desirable or even necessary. For this reason, other methods of conveying DACS identities are supported, such as through the HTTP Authorization header (RFC 2617) or the HTTP extension-header mechanism (RFC 2616). In fact, DACS can be customized or extended to accept any se
