Subject: [http-state] Cookie path and trailing "/"

From: Zhong Yu <[email-masked]>
Date: Mon, 1 Apr 2013 20:01:40 -0500

Hello cookie masters,

In the follow example of an http response, two cookies are set which
differs in the trailing slash of the Path attribute

    HTTP/1.1 200 OK
    Set-Cookie: n=v1; Path=/abc
    Set-Cookie: n=v2; Path=/abc/

According to RFC6265, these are two distinct cookies. And cookie#2 is not
applicable to request-path "/abc".

In my tests, IE and Chrome conform to these requirement. My question is,
are these requirement as intended? What was the reason behind?

On Firefox the two cookies are also treated as distinct cookies; however
Firefox erroneously sends cookie#2 for request-path "/abc". Should that be
considered a bug?

Thanks,
Zhong Yu

---

From: Adam Barth <[email-masked]>
Date: Mon, 1 Apr 2013 18:07:31 -0700

On Mon, Apr 1, 2013 at 6:01 PM, Zhong Yu <[email-masked]> wrote:
> Hello cookie masters,
>
> In the follow example of an http response, two cookies are set which differs in the trailing slash of the Path attribute
>
>     HTTP/1.1 200 OK
> According to RFC6265, these are two distinct cookies. And cookie#2 is not applicable to request-path "/abc".
>
> In my tests, IE and Chrome conform to these requirement. My question is, are these requirement as intended?

Yes.

> What was the reason behind?

Based on our testing at the time, it was the most widely implemented behavior.

> On Firefox the two cookies are also treated as distinct cookies; however Firefox erroneously sends cookie#2 for request-path "/abc". Should that be considered a bug?

If Firefox changes its behavior to match the spec, it will be more
interoperable with other user agents, which seems like a good thing.

Adam

---

From: Zhong Yu <[email-masked]>
Date: Mon, 1 Apr 2013 20:18:48 -0500

Cool, I'll file a bug to Firefox.

On Mon, Apr 1, 2013 at 8:07 PM, Adam Barth <[email-masked]> wrote:

> are these requirement as intended?
>
> Yes.
>

---

From: Zhong Yu <[email-masked]>
Date: Mon, 1 Apr 2013 20:28:35 -0500

Never mind, there's already a bug -
https://bugzilla.mozilla.org/show_bug.cgi?id=537207

I agree with Dan Witte that it's probably not a big deal, usually a server
application will consistently use one of the two forms (if the application
uses non-"/" Paths at all).

Zhong Yu

On Mon, Apr 1, 2013 at 8:18 PM, Zhong Yu <[email-masked]> wrote:

>> > On Firefox the two cookies are also treated as distinct cookies;
>> however Firefox erroneously sends cookie#2 for request-path "/abc". Should
>> that be considered a bug?
>>