Subject: Re: [http-state] Conformance classes

From: Dan Witte <[email-masked]>
Date: Tue, 15 Dec 2009 10:41:48 -0800 (PST)

----- "Adam Barth" <[email-masked]> wrote:
> If I were dwitte, I would change Firefox to match IE, but that's his
> call.  Having different behavior for Set-Cookie and document.cookie
> seems like needless complexity.

Given that it's doubtful any HTTP servers would issue an empty Set-Cookie header (though that's just a guess), and we haven't seen any bug reports to that effect, I'm inclined to leave our behavior as is for now. The spec should probably indicate that nameless, valueless cookies are a Really Bad Idea, and we can leave it at that.

If you think consistency of implementations or complexity of spec trumps my inaction argument, or that my assessment of the rarity of this case is wrong, I can certainly change it. It won't be that hard.

Regards,
Dan

---

From: Adam Barth <[email-masked]>
Date: Tue, 15 Dec 2009 10:50:22 -0800

> If you think consistency of implementations or complexity of spec trumps my inaction argument, or that my assessment of the rarity of this case is wrong, I can certainly change it. It won't be that…

Thanks Dan.  I've make this change to the draft.  We can revisit this
issue later if need.

Adam

---

From: Adam Barth <[email-masked]>
Date: Tue, 15 Dec 2009 11:04:17 -0800

> Thanks Dan.  I've make this change to the draft.  We can revisit this

As a point of interest, I've add test 0025:

Set-Cookie: foo
Set-Cookie: ; bar

IE, Firefox, Safari, and Chrome all agree that the second Set-Cookie
header field clears the cookie set by the first header field.

Adam