Subject: [http-state] Support of nameless cookies by user agents

From: Adam Barth <[email-masked]>
Date: Tue, 15 Dec 2009 22:34:57 -0800

I'd like to apologize to Roy.  I was mistaken about which user agents
support nameless cookies.  That was one of the first tests I wrote and
I misremembered the results.  Here's the compatibility matrix:

Test 004: Set-Cookie: foo

IE8, Firefox, Chrome: Cookie: foo
Safari, cURL: (no header)
Opera: Cookie: foo=

I've added a TODO to the draft.

Adam

---

From: Maciej Stachowiak <[email-masked]>
Date: Tue, 15 Dec 2009 22:45:47 -0800

> I've added a TODO to the draft.

This agrees with my testing. And from script (not fully relevant to  
the protocol, but perhaps of interest), document.cookie="foo" creates  
a cookie named "foo" with an empty value, rather than a nameless  
cookie, while document.cookie="" does nothing, so we would have been  
hit by the Mozilla bankofamerica bug cited earlier.

Regards,
Maciej

---

From: Maciej Stachowiak <[email-masked]>
Date: Tue, 15 Dec 2009 22:58:44 -0800

On Dec 15, 2009, at 10:45 PM, Maciej Stachowiak wrote:

> the protocol, but perhaps of interest), document.cookie="foo"  
> creates a cookie named "foo" with an empty value, rather than a  
> nameless cookie, while document.cookie="" does nothing, so we would  
> have been hit by the Mozilla bankofamerica bug cited earlier.

Side note: here is the bug where we added support for cookies without  
an = sign, implementing them as valueless rather than nameless,  
working around the lower level library:

https://bugs.webkit.org/show_bug.cgi?id=6531

The nature of the workaround means that cookies with no equal sign are  
only supported in script, not on the wire, but if you set one in  
script it will get sent in outgoing Cookie headers.

We have an internal bug to track adding support at the protocol level.

I was not able to find a bug (either in the bug system or internal)  
that could be readily identified as needing nameless cookies to be  
treated nameless instead of valueless. However, it is possible we have  
a site compatibility bug that is in fact about that issue, but no one  
has yet diagnosed it.

Regards,
Maciej

---

From: Adam Barth <[email-masked]>
Date: Tue, 15 Dec 2009 23:15:11 -0800

On Tue, Dec 15, 2009 at 10:58 PM, Maciej Stachowiak <[email-masked]> wrote:
> Side note: here is the bug where we added support for cookies without an =
> sign, implementing them as valueless rather than nameless, working around
> the lower level library:
>
> The nature of the workaround means that cookies with no equal sign are only
> supported in script, not on the wire, but if you set one in script it will
> get sent in outgoing Cookie headers.

If you'd like to improve compatibility with IE and Firefox, you might
consider representing these as nameless cookies instead of valueless
cookie.  You can observe the difference via test 0027:

Set-Cookie: foo
Set-Cookie: bar

> I was not able to find a bug (either in the bug system or internal) that
> could be readily identified as needing nameless cookies to be treated
> nameless instead of valueless. However, it is possible we have a site
> compatibility bug that is in fact about that issue, but no one has yet
> diagnosed it.
>
> Regards,
> Maciej

---

From: Dan Witte <[email-masked]>
Date: Wed, 16 Dec 2009 10:14:00 -0800 (PST)

> working around the lower level library:

Thanks for the link. I was about to ask whether you had something similar and why. I was thinking about removing nameless cookie support in Firefox to see if any of today's sites break; since your report is relatively recent I'm betting a handful would. Having nameless/valueless cookies not work in a major browser might go a long way toward discouraging their use, which could only be a good thing given the disparity of implementation across browsers.

Dan