Subject: fyi: draft-ietf-httpstate-cookie-15.txt

From: =JeffH <[email-masked]>
Date: Thu, 21 Oct 2010 10:42:32 -0700

FYI, we're getting very close to requesting RFC publication of 
draft-ietf-httpstate-cookie. Please send any feedback to <[email-masked]>

thanks,

=JeffH
------

Subject: [http-state] I-D Action:draft-ietf-httpstate-cookie-15.txt
From: [email-masked]
Date: Sun, 10 Oct 2010 10:30:02 -0700 (PDT)
To: [email-masked]
Cc: [email-masked]

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the HTTP State Management Mechanism Working Group 
of the IETF.

	Title           : HTTP State Management Mechanism
	Author(s)       : A. Barth
	Filename        : draft-ietf-httpstate-cookie-15.txt
	Pages           : 40
	Date            : 2010-10-10

This document defines the HTTP Cookie and Set-Cookie header fields.
These header fields can be used by HTTP servers to store state
(called cookies) at HTTP user agents, letting the servers maintain a
stateful session over the mostly stateless HTTP protocol.  Although
cookies have many historical infelicities that degrade their security
and privacy, the Cookie and Set-Cookie header fields are widely used
on the Internet.Editorial Note (To be removed by RFC Editor)

If you have suggestions for improving this document, please send
email to <mailto:[email-masked]>.  Suggestions with test cases
are especially appreciated.  Further Working Group information is
available from <https://tools.ietf.org/wg/httpstate/>.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-httpstate-cookie-15.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---
end

---

From: Willy Tarreau <[email-masked]>
Date: Thu, 21 Oct 2010 22:52:20 +0200

Hello,

> draft-ietf-httpstate-cookie. Please send any feedback to 

A few months ago, I reported one point to Adam which I think has since been
missed. The draft does not indicate that it obsoletes the parts related to
the Cookie header syntax of the RFC2965. But this RFC (re-)defined it,
explicitly allowing empty lone attributes, as well as quoted strings in the
value, both of which don't seem to be allowed anymore in latest draft, which
makes the equal sign mandatory and expects a token as the value.

So with 2965 not being obsoleted, both RFCs could be used to build possibly
incompatible implementations.

I don't know how this is normally dealt with. Is it possible to obsolete just
one part of an RFC ? (the cookie2 part of 2965 looks fine).

Regards,
Willy

---

From: Adam Barth <[email-masked]>
Date: Thu, 21 Oct 2010 13:59:18 -0700

> one part of an RFC ? (the cookie2 part of 2965 looks fine).

This has been fixed, but the fix is not yet reflected in the published
draft.  The plan is to obsolete RFC 2965 and move it to historic(al).

Adam

---

From: Willy Tarreau <[email-masked]>
Date: Thu, 21 Oct 2010 23:16:52 +0200

> draft.  The plan is to obsolete RFC 2965 and move it to historic(al).

OK, thank you Adam for the quick response.

Cheers,
Willy