Subject: [http-state] Errata and query on HTTP State Management Mechanism

From: "Glyn Geoghegan" <[email-masked]>
Date: Mon, 28 Mar 2011 15:07:56 +1000

Hi,

I've been reviewing "Internet-Draft, HTTP State Management Mechanism, March 2011" and noted a probable typo, as well as having a query.

Firstly, great work on attempting to deal with the cookie quagmire!

The apparent error I noted is in "4.1.2.2. The Max-Age Attribute".

I believe "In fact, user agents often evict cookies from due to memory pressure or privacy concerns" should read "In fact, user agents often evict cookies due to memory pressure or privacy concerns" as in 4.2.1.2.

On multiple Set-Cookies; 4.1.1 states "Servers SHOULD NOT include more than one Set-Cookie header field in the same response with the same cookie-name.  (See Section 5.2 for how user agents handle this case.)".

Having read 5.2 I'm still not clear on the suggested behaviour; our research indicates some user agents aggregate the set-cookie directives, some take the first and some take the last; obviously there are notable security implications.

It is implicit from 5.2 point 11 that, when parsing, each cookie will replace previously stored ones, but I can't see the specific case of multiple same name cookies in a single server response (and regardless it is noted elsewhere that the order of directives is not and should not be considered significant).

Please can you highlight the paragraphs that disambiguate the situation? (I'm probably missing something obvious, if so, apologies).

Cheers,
Glyn.

--

----------------------------------------------------------------------
CONFIDENTIALITY:  This e-mail and any files transmitted with it are
confidential and intended solely for the use of the recipient(s) only.
Any review, retransmission, dissemination or other use of, or taking
any action in reliance upon this information by persons or entities
other than the intended recipient(s) is prohibited.  If you have
received this e-mail in error please notify the sender immediately
and destroy the material whether stored on a computer or otherwise.
----------------------------------------------------------------------
DISCLAIMER:  Any views or opinions presented within this e-mail are
solely those of the author and do not necessarily represent those
of Corsaire Limited, unless otherwise specifically stated.
----------------------------------------------------------------------
Corsaire Limited, head office: Unit 2 Grosvenor Court, Hipley Street,
Old Woking, Surrey GU22 9LL. Telephone: +44 (0)1483-746700.
Registered in England No. 3338312. Registered office: Portland House,
Park Street, Bagshot, Surrey GU19 5PG.

---

From: Adam Barth <[email-masked]>
Date: Tue, 29 Mar 2011 08:42:19 -0700

> I believe "In fact, user agents often evict cookies from due to memory pressure or privacy concerns" should read "In fact, user agents often evict cookies due to memory pressure or privacy concerns…

Silly typos.  Gotta catch them all.

> Please can you highlight the paragraphs that disambiguate the situation? (I'm probably missing something obvious, if so, apologies).

Correct.  The spec requires the Set-Cookie headers to be processed in
the order received.  This is the dominate behavior, although I think
one or two user agents process them in the reverse order.  Excitingly
nutty things happen if you have two cookies with the same name and
different paths.

Adam