Subject: [http-state] test data question

From: Vasiliy Baranov <[email-masked]>
Date: Tue, 22 Nov 2011 20:13:56 +0400

Hello,

I have a cookie implementation that attempts to follow RFC 6265. If I 
run it against the test data found in 
https://github.com/abarth/http-state, the following test fails:

     tests/data/parser/name0032-test:

         Set-Cookie: "foo\"bar;baz"=qux

     tests/data/parser/name0032-expected:

         Set-Cookie: "foo\"bar

I am by no means an expert in this area but it seems to me this test 
goes against the spec, in particular, the following statement found in 
RFC 6265 on page 17:

    2.  If the name-value-pair string lacks a %x3D ("=") character,
        ignore the set-cookie-string entirely.

My understanding is, for the test in question the name-value-pair is 
'"foo\"bar'. This name-value-pair obviously lacks the "=" character, so 
my reading of the spec is the cookie should be rejected entirely. The 
test, however, expects the cookie to be accepted and sent back to the 
server on the subsequent request. Does that mean my reading of the spec 
is incorrect?

I tried this test in Chrome 16.0.912.41 beta-m, Firefox 6.0.1, IE 8, and 
Safari 5.0.5. It passes everywhere except for Safari and my poor 
implementation.

Thanks,
-- Vasiliy

---

From: Adam Barth <[email-masked]>
Date: Tue, 22 Nov 2011 10:36:34 -0800

Thanks for the report.  This is an error in the test suite, which I'll fix.

The test is from an older version of the spec that allowed "valueless"
cookies.  The working group decided to remove the concept of valueless
cookies (we can look up the tracker number if you want to see exactly
why).

Thanks again,
Adam

On Tue, Nov 22, 2011 at 8:13 AM, Vasiliy Baranov
<[email-masked]> wrote:
> Hello,
>
> I have a cookie implementation that attempts to follow RFC 6265. If I run it
> against the test data found in https://github.com/abarth/http-state, the
> following test fails:
>
> I am by no means an expert in this area but it seems to me this test goes
> against the spec, in particular, the following statement found in RFC 6265
> on page 17:
>
> '"foo\"bar'. This name-value-pair obviously lacks the "=" character, so my
> reading of the spec is the cookie should be rejected entirely. The test,
> however, expects the cookie to be accepted and sent back to the server on
> the subsequent request. Does that mean my reading of the spec is incorrect?
>
> _______________________________________________
> http-state mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-state
>

---

From: Adam Barth <[email-masked]>
Date: Tue, 22 Nov 2011 10:39:26 -0800

> Thanks for the report.  This is an error in the test suite, which I'll fix.

Done.

---

From: Vasiliy Baranov <[email-masked]>
Date: Wed, 23 Nov 2011 14:09:33 +0400

Hi Adam,

Thank you for clarifying this and fixing the test.

Also, thank you and the group for the RFC and the test suite. They help 
so much.

Thank you,
-- Vasiliy

On 22.11.2011 22:39, Adam Barth wrote:
> On Tue, Nov 22, 2011 at 10:36 AM, Adam Barth<[email-masked]>  wrote: