Subject: Re: [http-state] Is this an omission in the parser rules of draft-ietf-httpstate-cookie-21?

From: "Remy Lebeau" <[email-masked]>
Date: Fri, 04 Feb 2011 17:24:00 -0700

-------- Original Message --------
Subject: Re: [http-state] Is this an omission in the parser rules of
draft-ietf-httpstate-cookie-21?
From: Adam Barth <[email-masked]>
Date: Fri, February 04, 2011 11:29 am
To: "Roy T. Fielding" <[email-masked]>
Cc: Remy Lebeau <[email-masked]>, [email-masked]

> The grammar is not used for parsing.  Parsing
> is defined in Section 5, not Section 4.

Section 5 describes how to parse Set-Cookie headers. RFC 2109 grammer
(and real-world use, which you seem to deny exists) for Set-Cookie
headers specifically defines both cookie values and attribute values as
being a "value" type, which is defined as follows:

   value           =       word
   word            =       token | quoted-string

Why can't Section 5 be updated to allow parsing of quoted-string values?
They ARE in use in the real world! They ARE NOT opaque in attribute
values. They are grammar elements that some servers really do use, and
should be parsed as such. I think Section 5 needs to adopt RFC 2109's
definition of the "value" and/or "word" type, instead of using "token"
exclusively.

---

From: Adam Barth <[email-masked]>
Date: Fri, 4 Feb 2011 16:27:51 -0800

On Fri, Feb 4, 2011 at 4:24 PM, Remy Lebeau <[email-masked]> wrote:
> From: Adam Barth
> To: "Roy T. Fielding"
> Cc: Remy Lebeau , [email-masked]
>

Remy, please calm down.  Section 5 does not use token at all, much
less exclusively.  Can you provide an example of a Set-Cookie header
that you believe is processed incorrectly by Section 5?

Adam