Subject: Re: [http-state] Is this an omission in the parser rules of draft-ietf-httpstate-cookie-21?

From: Adam Barth <[email-masked]>
Date: Thu, 3 Feb 2011 19:12:54 -0800

On Thu, Feb 3, 2011 at 6:54 PM, Remy Lebeau <[email-masked]> wrote:
>
> -------- Original Message --------
> Subject: Re: [http-state] Is this an omission in the parser rules of
> draft-ietf-httpstate-cookie-21?
> From: Adam Barth <[email-masked]>
> Date: Thu, February 03, 2011 12:18 pm
> To: Remy Lebeau <[email-masked]>
> Cc: [email-masked]
>
>> It's not an omission.  The use of quotation mark for cookie values in
>> RFC 2109 do not reflect how cookie behave in actual use.
>
> Just a minute ago, while logging in to Yahoo webmail, I noticed the
> server issue a cookie that uses quotations, and my IE 8 webbrowser sent
> back 3 cookies that used quotations.  See below.  Quotes in cookies are
> a real-world possibility, so the draft should allow for their presence,
> at least for user agents that parse cookies, if not in origin servers
> that generate them.

I should be more clear.  Quotation marks are not special characters in
cookie values.  They have no effect on how cookies are processed.  Any
use of quotation marks by servers is pure superstition, just like
using a leading "." before the value of the Domain attribute.

Adam

---

From: Julian Reschke <[email-masked]>
Date: Fri, 04 Feb 2011 09:28:38 +0100

On 04.02.2011 04:12, Adam Barth wrote:
> On Thu, Feb 3, 2011 at 6:54 PM, Remy Lebeau<[email-masked]>  wrote:
>>
>> From: Adam Barth<[email-masked]>
>> To: Remy Lebeau<[email-masked]>
>> Cc: [email-masked]
>>
 > ...

Which leaves us with two questions:

1) Should they be allowed by the grammar in Section 4?

2) This is a normative change. Shouldn't there be a section that 
explains what the normative differences compared to 2109 are?

Best regards, Julian

---

From: Adam Barth <[email-masked]>
Date: Fri, 4 Feb 2011 00:32:03 -0800

> 1) Should they be allowed by the grammar in Section 4?

There's some discussion earlier on this list about changing the
grammar for cookie-value to include the base64 characters.  IMHO,
that's vastly more useful than pretending like quote marks mean
anything in this context.

> 2) This is a normative change. Shouldn't there be a section that explains
> what the normative differences compared to 2109 are?

We haven't done that for any of the other "changes" since 2109.  IMHO,
we'll lead happier lives if we act as if 2109 never existed.

Adam

---

From: "Remy Lebeau" <[email-masked]>
Date: Thu, 03 Feb 2011 19:54:57 -0700

-------- Original Message --------

Set-Cookie:
path=/; expires=Sun, 03-Feb-2013 02:38:15 GMT

Cookie:
uid=uid=b249f7d0-2601-11e0-8920-001e68573c97&_hmacv=1&_salt=3936148460&_keyid=k1&_hmac=0d5fcfcf37c7173d31892209a8cc640e7ed2e099;
BX=771n6td5mp9rd&b=4&s=n2&i=3A3TVVRodzDgIL.ooQ9Q&t=293;
pc1="b!!!!#!#4wO!!%!L!#0n,!/9nd!$^P'!!!!$!?5%!%n/M2!ZmB)!$Za$!%TB`~~~~~~<h@UX~~"