Subject: Re: [http-state] Is this an omission in the parser rules ofdraft-ietf-httpstate-cookie-21?

From: "Remy Lebeau" <[email-masked]>
Date: Wed, 16 Feb 2011 15:21:59 +0000

Expires was not in the RFC 2109 grammar for the Set-Cookie header, but most implementations did not use Max-Age. The draft allows user agents to support both from a server, and RFC 2109 Section 10.1.2 told user agents to recognize Expires if present:

10.1.2  Expires and Max-Age

   Netscape's original proposal defined an Expires header that took a date value in a fixed-length variant format in place of Max-Age:

   Wdy, DD-Mon-YY HH:MM:SS GMT

   Note that the Expires date format contains embedded spaces, and that "old" cookies did not have quotes around values.  Clients that implement to this specification should be aware of "old" cookies and Expires.

The wording of that last sentence does not suggest to me, at least, that the presence of Expires is strictly dependant on an "old" cookie being used. And we can see in real-world cookies that Netscape-style Expires are commonly used in RFC-style cookies from servers.

------Original Message------
From: Dan Winship
To: Remy Lebeau
Cc: [email-masked]
Cc: [email-masked]
Subject: Re: [http-state] Is this an omission in the parser rules	ofdraft-ietf-httpstate-cookie-21?
Sent: Feb 16, 2011 5:30 AM

On 02/16/2011 02:04 AM, Remy Lebeau wrote:
> Since the cookie has a Version=1 attribute, it is an RFC 2109 cookie,
> and RFC 2109 allows Netscape-style date/time formatting:
> 
>    Wdy, DD-Mon-YYYY HH:MM:SS GMT

Not that any of this is in any way relevant, but, no it doesn't. RFC
2109 doesn't allow the Expires attribute at all. A cookie that contains
both "Version=1" and "Expires=..." does not conform to *any* spec.

-- Dan