Subject: [http-state] Set-Cookie vs header folding

From: Julian Reschke <[email-masked]>
Date: Mon, 06 Sep 2010 14:16:31 +0200

Hi,

we are all aware of the problem of Set-Cookie of being compatible with 
the HTTP header field list syntax.

See 
<http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p1-messaging-11.html#rfc.section.3.2.p.7>:

"Note: The "Set-Cookie" header as implemented in practice (as opposed to 
how it is specified in [RFC2109]) can occur multiple times, but does not 
use the list syntax, and thus cannot be combined into a single line. 
(See Appendix A.2.3 of [Kri2001] for details.) Also note that the 
Set-Cookie2 header specified in [RFC2965] does not share this problem."

and also <http://trac.tools.ietf.org/wg/httpbis/trac/ticket/129>.

I was just checking whether HTTPbis needs to change once the new cookie 
spec is published, and was surprised that it doesn't seem to mention 
this problem (as known incompatibility with the requirements in 2616). I 
believe it should.

Best regards, Julian

---

From: Adam Barth <[email-masked]>
Date: Mon, 6 Sep 2010 09:29:11 -0700

We've discussed this issue before.  Here's what the draft says:

[[
   Origin servers can send a Set-Cookie response header with any
   response.  An origin server can include multiple Set-Cookie header
   fields in a single response.  Note that folding multiple Set-Cookie
   header fields into a single header field might change the semantics
   of the header because the U+002C (",") character is used by the Set-
   Cookie header in a way that conflicts with such folding.
]]

Kind regards,
Adam

On Mon, Sep 6, 2010 at 5:16 AM, Julian Reschke <[email-masked]> wrote:
> Hi,
>
> we are all aware of the problem of Set-Cookie of being compatible with the
> HTTP header field list syntax.
>
> See
> "Note: The "Set-Cookie" header as implemented in practice (as opposed to how
> it is specified in [RFC2109]) can occur multiple times, but does not use the
> list syntax, and thus cannot be combined into a single line. (See Appendix
> A.2.3 of [Kri2001] for details.) Also note that the Set-Cookie2 header
> specified in [RFC2965] does not share this problem."
>
> I was just checking whether HTTPbis needs to change once the new cookie spec
> is published, and was surprised that it doesn't seem to mention this problem
> (as known incompatibility with the requirements in 2616). I believe it
> should.
>
> Best regards, Julian
> _______________________________________________
> http-state mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-state
>

---

From: Julian Reschke <[email-masked]>
Date: Mon, 06 Sep 2010 19:08:25 +0200

> We've discussed this issue before.  Here's what the draft says:

Right.

>     Cookie header in a way that conflicts with such folding.

Yes. I was looking for text that refers to RFC 2616, that's why I didn't 
find it this morning.

I think it would be helpful to split this into two paragraphs, and to be 
more explicit that this is a known incompatibility with RFC 2616's 
header syntax.

Best regards, Julian

---

From: Adam Barth <[email-masked]>
Date: Mon, 6 Sep 2010 10:20:26 -0700

On Mon, Sep 6, 2010 at 10:08 AM, Julian Reschke <[email-masked]> wrote:
> more explicit that this is a known incompatibility with RFC 2616's header
> syntax.

That sounds reasonable.  I'm got to batch up trivial comments like
this one and handle them together with whatever comments we get back
from IETF LC.

Adam

---

From: Adam Barth <[email-masked]>
Date: Thu, 16 Sep 2010 01:13:26 -0700

> this one and handle them together with whatever comments we get back

Done:

http://github.com/abarth/http-state/commit/4ee20f68e45530ce4dbba1caf84817492cdd633e

Adam