Subject: [http-state] session length

From: Daniel Stenberg <[email-masked]>
Date: Fri, 21 Aug 2009 10:57:43 +0200 (CEST)

Hi friends,

I detected a contradiction regarding what a cookie session is or when it ends. 
In the description for Max-Age and Expires, the current draft says

       If the server does not supply an Expires or a
       Max-Age attribute, the lifetime of the cookie is limited to the
       current session (as defined by the user agent).

While later on it speaks of the storage model in section 5.2 and then it 
instead says that you cannot have a session that outlives the user agent:

    When the user agent exits, the user agent MUST remove from the cookie
    store all cookies with the persistent field set to false.

'persistent' is said to be a Boolean to keep with cookies to mark them as 
session cookies basically. But I'm not happy with that, since I think it will 
make everyone think that's how session cookies have to work while I much 
rather subscribe to the earlier words: "defined by the user agent".

I could imagine user-agents having "persistent" set to a last-used time 
instead and simply discard session cookies that haven't been used for a set 
period of time. That would allow user-agents to for example time-out cookies 
for site-logins etc. Not to mention that some user-agents may start and exit 
numerous times during a single session by its definition of a session. 
IOW: "defined by the user agent"...

-- 

  / daniel.haxx.se

---

From: Adam Barth <[email-masked]>
Date: Fri, 21 Aug 2009 09:12:29 -0700

I've replace that text with the following:

        <t>When "the current session is over", the user agent MUST remove from
        the cookie store all cookies with the persistent field set to
        false.
        <list>
          <t>NOTE: This document does not define when "the current session
          is over."  Many user agents remove non-persistent cookies when
          they exit.  However, other user agent expire non-persistent
          cookies using other heuristics.</t>
        </list>
        </t>

Let me know if you'd like further modifications.

Adam

On Fri, Aug 21, 2009 at 1:57 AM, Daniel Stenberg<[email-masked]> wrote:
> Hi friends,
>
> I detected a contradiction regarding what a cookie session is or when it
> ends. In the description for Max-Age and Expires, the current draft says
>
> session cookies basically. But I'm not happy with that, since I think it
> will make everyone think that's how session cookies have to work while I
> much rather subscribe to the earlier words: "defined by the user agent".
>
> numerous times during a single session by its definition of a session. IOW:
> "defined by the user agent"...
>
> --
>
>  / daniel.haxx.se
> _______________________________________________
> http-state mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-state
>