Re: [http-state] Updated draft

[Daniel Stenberg <[e-mail]>]

On Sun, 16 Aug 2009, Adam Barth wrote:

> User agents comprising >99% of the market share implement path-length 
> sorting.  The only implementation I'm aware of that does not perform 
> path-length sorting is CURL.  Are there other implementations we should 
> factor into our decisions?

Right, but did you check libsoup, wget or whatever other fairly common 
non-browser http clients there are out there? Or why not the most popular 
native libs for Java, Python or perl?

As curl is not a browser at all you could test 100% of the browsers and curl 
would still not be in that lump. You cannot use browser share among end users 
as a proper measurement here. If you can reach 99% of the server 
implementations it would matter a lot more.

> I suspect that Internet Explorer, Firefox, Safari, Chrome, and Opera have 
> collectively been tested on more web sites than CURL.  When 5 out of 5 major 
> browsers agree, there's likely a reason.

Then please tell me the reason. Why do they sort the cookies like this? (And I 
don't count "because RFC2109/2965 says so" to be a good explanation.)

And the reversed: how come (virtually) no server-side receivers care about the 
order?

> "If I were going to implement a new user agent today and I wanted to 
> maximize compatibility, would I implement this requirement?"
>
> In this case, it's clear that I would want to implement a behavior that 
> matches all of the major browsers.

I think you're looking at it from the wrong perspective. If I were to 
implement a new cookie "engine" today and maximize compatibility, I would make 
sure that it plays with 99.[something] of the _server_-implementions. And 
funnily enough, I claim that curl does!

A request-header should be looked for compliance in the server-end, imo.

Obviously I don't have any measured numbers to back this up but curl has 
always been used a lot to mimic browsers and to automate what people otherwise 
do manually with browsers, and I've always put in an effort to make sure that 
curl can do everything the browsers can (HTTP wise). This sorting thing has 
never been an issue to my knowledge (and yes I do realize I'm sticking my neck 
out here).

>> it could only really have a meaning if more than 50 (or so) cookies are 
>> stored for a domain as then the sort order would decide which cookies to 
>> discard
>
> This is not the case.  The priority order for evicting cookies is different 
> from the order in which cookies appear in the Cookie header (which is what 
> we're discussing).

Ah, that's what I get for reading it sloppy, sorry.

But it only makes my point even stronger: Why do we specify the order at all? 
What's the useful purpose to any party involved?

-- 

  / daniel.haxx.se