Subject: [http-state] Updated draft with Expires

From: Adam Barth <[email-masked]>
Date: Sat, 7 Nov 2009 01:19:24 -0800

I've replaced the vague date grammar for the Expires attribute with a
precise date parsing algorithm.  The web site won't let me upload a
new draft because the IETF meeting is happening soon, but I've
attached the draft to this message.

Next up...  the Domain attribute.

Adam

---

From: Daniel Stenberg <[email-masked]>
Date: Sat, 7 Nov 2009 10:44:59 +0100 (CET)

On Sat, 7 Nov 2009, Adam Barth wrote:

> precise date parsing algorithm.  The web site won't let me upload a new 
> draft because the IETF meeting is happening soon, but I've attached the 
> draft to this message.

Nice work. I've yet to read it through properly, but a thought struck me at 
once when reading the new section on how to treat expire strings:

Do user agents in general work fine with expire dates before 1-jan-1970 ? It 
would imply a negative time_t if we speak POSIX, and I know for sure that curl 
doesn't properly parse/handle older dates and I've seen exactly 1-jan-1970 
used in several places when when sites want to expire existing cookies.

-- 

  / daniel.haxx.se

---

From: Adam Barth <[email-masked]>
Date: Sat, 7 Nov 2009 08:12:42 -0800

On Sat, Nov 7, 2009 at 1:44 AM, Daniel Stenberg <[email-masked]> wrote:
> would imply a negative time_t if we speak POSIX, and I know for sure that
> curl doesn't properly parse/handle older dates and I've seen exactly
> 1-jan-1970 used in several places when when sites want to expire existing
> cookies.

That's a good point.  I've added these statements:

          <t>If the expiry-time is later than the last date the user agent
          can represent, the user agent MAY replace the expiry-time with the
          last representable date.</t>

          <t>If the expiry-time is earlier than the first date the user agent
          can represent, the user agent MAY replace the expiry-time with the
          first representable date.</t>

Clearly we can't ask user agents to represent unrepresentable dates.  :)

It probably doesn't matter too much exactly what range of dates (e.g.,
POSIX) the user agent can represent unless we expect people to set
cookies that expire in the distant future or past.

Adam

---

From: Adam Barth <[email-masked]>
Date: Sat, 7 Nov 2009 08:28:37 -0800

Thanks Yui.  I presume you're suggesting that we replace the grammar
in Section 4.1.1 (part of server conformance) with this grammar.

In general, I like the idea of a more descriptive grammar for that
section.  I have two questions:

1) It looks like domain-value can be ".."  Is that what you mean?
2) I don't see FWS defined.  What does that mean?

I've added a TODO to the draft to consider your grammar in more detail
when I cycle back from the UA conformance section to the server
conformance section.

Adam

On Sat, Nov 7, 2009 at 3:00 AM, NARUSE, Yui <[email-masked]> wrote:
> Adam Barth wrote:
> Hi,
> I wrote Cookie syntax in ABNF.
> It is based on Netscape's draft and HttpOnly extension.
>
> Differences it and draft-abarth-cookie-03 are following,
> * cookie-pair is the first pair of Set-Cookie
>  (Netscape's spec and IE implementation)
> * name and value is http-token
>  (stricter than Netscape's spec, same as RFC 2965)
> * remove Max-Age
> * cookie-date allows only Netscape's Cookie date
>
>
> Set-Cookie      = "Set-Cookie:" [FWS] a-cookie [FWS]
> a-cookie        = cookie-pair *([FWS] ";" [FWS] cookie-av)
> cookie-av       = expires-av / domain-av / path-av
>                 / secure-av / httponly-av
>
> cookie-pair     = name [FWS] "=" [FWS] value
> name            = http-token
> value           = http-token                ; IE6+ doesn't allow TABs
>
> expires-av      = "Expires" [FWS] "=" [FWS] cookie-date
> cookie-date     = <Wdy, DD-Mon-YYYY HH:MM:SS GMT>      ; not RFC 2822
>
> domain-av       = "Domain" [FWS] "=" [FWS] domain-value
> domain-value    = ["."] dot-http-token     ; xx.yy doesn't work on IE
> dot-http-token  = "." / http-token
>
> path-av         = "Path" [FWS] "=" [FWS] path-value
> path-value      = abs_path
> abs_path        = <RFC 2616 abs_path>
>
> secure-av       = "Secure"
> httponly-av     = "HttpOnly"
>
> Cookie          = "Cookie:" [FWS] cookie-value
>                 *([FWS] ";" [FWS] cookie-value) [FWS]
>
>
> # RFC 2068 HTTP/1.1
> CHAR           = <any US-ASCII character (octets 0 - 127)>
> DIGIT          = <any US-ASCII digit "0".."9">
> CTL            = <any US-ASCII control character</pp>
>                 (octets 0 - 31) and DEL (127)>
> CR             = <US-ASCII CR, carriage return (13)>
> LF             = <US-ASCII LF, linefeed (10)>
> SP             = <US-ASCII SP, space (32)>
> HT             = <US-ASCII HT, horizontal-tab (9)>
> CRLF           = CR LF
> LWS            = [CRLF] 1*( SP | HT )
> HEX            = "A" | "B" | "C" | "D" | "E" | "F"
>                | "a" | "b" | "c" | "d" | "e" | "f" | DIGIT
> tspecials      = "(" | ")" | "<" | ">" | "@"
>                | "," | ";" | ":" | "\" | <">
>                | "/" | "[" | "]" | "?" | "="
>                | "{" | "}" | SP | HT
> token          = 1*<any CHAR except CTLs or tspecials>
>
> --
> NARUSE, Yui  <[email-masked]>
>