Subject: status of rfc6265bis?

From: Julian Reschke <[email-masked]>
Date: Mon, 13 Feb 2017 12:45:25 +0100

Hi there,

so what's going on here? It seems nothing has happened since early 
October? Are we still working on this?

Related to that: there was recently a heated discussion over in 
<https://issues.apache.org/jira/browse/HTTPCLIENT-1006> about whether 
clients are supposed to round-trip the "quoted-string"-ness of a cookie. 
I think I know what the answer is, but it's certainly not clear enough 
in the existing spec. Feedback from our cookie experts would be awesome...

Best regards, Julian

---

From: Daniel Veditz <[email-masked]>
Date: Mon, 13 Feb 2017 08:23:44 -0800

Currently all the major browser engines agree and return the quotes as part
of the cookie, which seems to be what the spec says (DQUOTEs are part of
the cookie value). Most servers seem to work fine with this behavior and no
one knows what will break if browsers start handling this differently.

Browsers also allow, and some web applications use, spaces and UTF-8
sequences in cookies which are technically not valid cookie-octets; we
should probably make this part of the spec match reality if we can figure
out what that is.

-Dan Veditz

On Mon, Feb 13, 2017 at 3:45 AM, Julian Reschke <[email-masked]>
wrote:

> Related to that: there was recently a heated discussion over in <
> https://issues.apache.org/jira/browse/HTTPCLIENT-1006> about whether
> clients are supposed to round-trip the "quoted-string"-ness of a cookie. I
> think I know what the answer is, but it's certainly not clear enough in the
> existing spec. Feedback from our cookie experts would be awesome...
>
> Best regards, Julian
>
>

---

From: Julian Reschke <[email-masked]>
Date: Mon, 13 Feb 2017 17:50:28 +0100

On 2017-02-13 17:23, Daniel Veditz wrote:
> Currently all the major browser engines agree and return the quotes as
> part of the cookie, which seems to be what the spec says (DQUOTEs are
> part of the cookie value). Most servers seem to work fine with this
> behavior and no one knows what will break if browsers start handling
> this differently.

That's how I read the spec as well; however, I failed to convince the 
main Apache HttpClient committer. Maybe there's something we can do to 
make it clearer.

> should probably make this part of the spec match reality if we can
> figure out what that is.
> ...

Agreed.

Best regards, Julian

---

From: Adam Barth <[email-masked]>
Date: Mon, 13 Feb 2017 11:05:15 -0800

On Mon, Feb 13, 2017 at 8:50 AM, Julian Reschke <[email-masked]>
wrote:

> That's how I read the spec as well; however, I failed to convince the main
> Apache HttpClient committer. Maybe there's something we can do to make it
> clearer.
>

That was also my intent when writing that passage.  See:

https://github.com/abarth/http-state/blob/master/tests/data/parser/value0002-test
https://github.com/abarth/http-state/blob/master/tests/data/parser/value0002-expected

Adam

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 14 Feb 2017 11:33:08 +1100

On 13 Feb 2017, at 10:45 pm, Julian Reschke <[email-masked]> wrote:
> 
> so what's going on here? It seems nothing has happened since early October? Are we still working on this?

We (the chairs) have talked to the editor, and he assures us that he'll be able to start in earnest in the near future. Stay tuned.

Cheers,

--
Mark Nottingham   https://www.mnot.net/