Subject: Re: [http-state] IETF-wide Last Call for -httpstate-cookie-10 ?

From: =JeffH <[email-masked]>
Date: Wed, 01 Sep 2010 13:55:38 -0700

> I setup a little CGI that can be used to check what your browser thinks:
 >
 >  	http://daniel.haxx.se/cookie.cgi
 >
 > It sends a single cookie header that looks like:
 >
 >  	"Set-Cookie: testme=yesyes; expires=Wed Sep  1 22:01:55 69;"
 >
 > The script prints the Cookie: headers, so if you reload you should see
 > "testme=yesyes" being output if the cookie is still there. If the cookie is
 > still there, your browser of choice treats the date above as a date in the
 > future.

thanks for doing that.

 >    curl (2147483647 seconds)

huh, my calcs indicate 2147483647 (sec) ~= 68 (yr)  ?     If that then is 
treated as "future", yet something else is going on (in curl) ?

 > Most clients seem to agree that '69' refers to '2069'.

Ok, so the issue with the spec AFAICT is not /just/ with year tokens of '69', 
but with these two rules from section 5.1.1. "Dates"...

    3.  If the year-value is greater than 68 and less than 100, increment
        the year-value by 1900.

    4.  If the year-value is greater than or equal to 0 and less than 69,
        increment the year-value by 2000.

might you be able to tweak your .cgi script to test all year values from 0 <= 
year <= 100 such that we can see in detail what all happens to which year values?

thanks,

=JeffH

---

From: Daniel Stenberg <[email-masked]>
Date: Wed, 1 Sep 2010 23:39:01 +0200 (CEST)

> treated as "future", yet something else is going on (in curl) ?

Sorry, that was carelessly expressed. curl detects that the date is in the 
future, but as I ran it 32bit it cannot express that time in a time_t in 
seconds since 1970 so it stores the largest value it has for it. 2147483647 is 
68 years from 1970, so it becomes the year 2038.

> might you be able to tweak your .cgi script to test all year values from 0 
> <= year <= 100 such that we can see in detail what all happens to which year 
> values?

Great idea. I'll need to post those results in a separate post, as I'm trying 
to make sense from them. Stay tuned.

-- 

  / daniel.haxx.se