Subject: Re: [http-state] Testing all 2-digit years in 'expires'

From: "Dan Witte" <[email-masked]>
Date: Thu, 02 Sep 2010 08:11:21 -0700

Neat. Do you think the 10 - 69 range makes sense? The epoch is somewhat historical (ha ha!) now, but I suppose it's reasonable.

FWIW I think the other browsers will have similar cookie limits, so you may want to play with them again too?

In any case, I think we could add a sentence or two to the spec about two-digit years being evil, but I don't think we need to get specific. Thoughts?

Dan

----- Reply message -----
From: "Daniel Stenberg" <[email-masked]>
Date: Wed, Sep 1, 2010 10:03 pm
Subject: [http-state] Testing all 2-digit years in 'expires'
To: "Dan Witte" <[email-masked]>
Cc: "HTTP-state mailing list" <[email-masked]>

On Wed, 1 Sep 2010, Dan Witte wrote:

>> When the user reloads this page, the page prints all "test$yy" cookies that 
>> get sent to the server.
>
> Did you account for the cookie-per-host limits in your test?

No. I described the exact process: 100 cookies named testYY. The only thing I 
didn't mention is that I set an extra cookie named 'works' to see that the 
date format is accepted with 4 digits for the year.

> Firefox will cap at 50, so you'll only get the most recent ones you set.

Great point and thanks for the hint. This explains the funny start year of 21 
then as 10 to 20 most likely went over the cookie-per-host limit.

-- 

  / daniel.haxx.se

---

From: Daniel Stenberg <[email-masked]>
Date: Thu, 2 Sep 2010 20:31:58 +0200 (CEST)

On Thu, 2 Sep 2010, Dan Witte wrote:

> Neat. Do you think the 10 - 69 range makes sense? The epoch is somewhat 
> historical (ha ha!) now, but I suppose it's reasonable.

I'm guessing 1970 is probably used for some cookies when they want to 
explicity set themselves outdated (based on it being the epoch time) so I 
guess 70 is just a sloppy way of doing that, and with that reasoning 10-69 
could very well be seen as future.

> want to play with them again too?

I'm afraid I don't know how to do that with any other browser. And I'm not 
sure it is even worth persuing this a lot more than what I've already did.

> In any case, I think we could add a sentence or two to the spec about 
> two-digit years being evil, but I don't think we need to get specific. 
> Thoughts?

I think we could be specific to increase interoperability even with crazy 
data. I'm in favour of advocating 00-69 to be 2000-2069 and 70-99 to be 
1970-1999, but also mentioning the flux of previous implementations and the 
need for servers to avoid 2-digit years.

-- 

  / daniel.haxx.se

---

From: Adam Barth <[email-masked]>
Date: Thu, 2 Sep 2010 11:39:19 -0700

> need for servers to avoid 2-digit years.

That sounds right to me.  We should probably mention the
interoperability issues with 2-digit years both in the Server
Requirements section (normatively) and in the User Agent Requirements
section (informatively).

Adam

---

From: Daniel Stenberg <[email-masked]>
Date: Fri, 3 Sep 2010 20:14:54 +0200 (CEST)

> sure it is even worth persuing this a lot more than what I've already did.

I got slightly more info on this topic which was useful.

Opera has confirmed to have a limit of 30 cookies per host by default, which 
explains the 41-69 limit. Without that limit, it treats 10-69 as future.

Without testing and just based on the fact that Firefox-limit-50 had 21-69 and 
Opera-limit-30 had 41-69 it's not unthinkable that IE has a limit of 40 
cookies which would explain the 31-69.

IOW, the major browsers agree on 10-69 being the future, with Chrome 
disagreeing slightly with 10-68.

-- 

  / daniel.haxx.se

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Fri, 03 Sep 2010 20:29:29 +0200

>disagreeing slightly with 10-68.

The test results I reported earlier contradict your assumption about IE,
I found Internet Explorer to wrap at 79/80 just like your results would
indicate. (This does remind me however that someone should check, if an
implementation imposes a limit, which cookies are disregarded, the first
<limit>, the last <limit>, or something else, and if the draft matches.)
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Daniel Stenberg <[email-masked]>
Date: Fri, 3 Sep 2010 23:19:38 +0200 (CEST)

On Fri, 3 Sep 2010, Bjoern Hoehrmann wrote:

> The test results I reported earlier contradict your assumption about IE, I 
> found Internet Explorer to wrap at 79/80 just like your results would 

Argh, I can't even read my own results. Sorry for being sloppy and thanks for 
correcting me.

Yes, it showed 31-79 in my tests so I guess their "epoch" is 1980 and that 
they limit cookies to 50 per host.

-- 

  / daniel.haxx.se

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Sat, 04 Sep 2010 18:02:07 +0200

><limit>, the last <limit>, or something else, and if the draft matches.)

A quick test suggests, when the Set-Cookie headers all appear in one
response, IE and Opera take the last <limit> cookies, Firefox picks a
largely random bunch plus the last one, and I could not find mention
of this in the draft.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Dan Witte <[email-masked]>
Date: Sat, 4 Sep 2010 13:25:11 -0700 (PDT)

----- Original Message -----
> largely random bunch plus the last one, and I could not find mention

Good catch. On most platforms, Firefox will pick the last <limit>, but on ones where timer resolution is poor (by the method we measure it) we can get different results. I'm going to fix this for Firefox 4.

Cheers,
Dan.