Re: [http-state] Welcome to http-state

Adam Barth wrote on 1/12/2009 3:59 PM: 
> The Cookie-Integrity header has two advantages over altering the
> semantics of Set-Cookie:

I brought this up on the old list; what about using $Version instead?

Something like:

	Set-Cookie: a=b; Version="3"; HTTPOnly; Secure

which the browser responds:

	Cookie: $Version="3"; a=b; $Integrity="HTTPOnly,Secure"

Of course, we're reworking the cookie spec, so presumably we can choose a better method (which may be the Cookie-Integrity header).  One idea I tossed around with Yngve was to repurpose Cookie2 (which only Opera currently supports) and make it the "new" cookie standard.  Then it's just a matter of educating developers to use Cookie2 instead of Cookie (and makes discussion about the update easier).  Because of the limited deployment of Cookie2, I'd imagine any backwards compatibility problems would be also limited.

- Bil

_______________________________________________
http-state mailing list
http-state@ietf.org
https://www.ietf.org/mailman/listinfo/http-state