[http-state] [Errata Verified] RFC6265 (6093)

RFC Errata System <rfc-editor@rfc-editor.org> Wed, 12 February 2025 11:50 UTC

To: toraritte@gmail.com, abarth@eecs.berkeley.edu
From: RFC Errata System <rfc-editor@rfc-editor.org>
Content-Type: text/plain; charset="UTF-8"
Message-Id: <20250212115021.922FF23E262@rfcpa.rfc-editor.org>
Date: Wed, 12 Feb 2025 03:50:21 -0800
Message-ID-Hash: ZYIVROCHOKXCQM4ZTTMEFH2KSIW7DLLH
CC: francesca.palombini@ericsson.com, iesg@ietf.org, http-state@ietf.org, iana@iana.org, rfc-editor@rfc-editor.org
Precedence: list
Subject: [http-state] [Errata Verified] RFC6265 (6093)
Archived-At: <https://mailarchive.ietf.org/arch/msg/http-state/1m8Bj44qYk7yNspi68MItEUFlSI>

The following errata report has been verified for RFC6265,
"HTTP State Management Mechanism". 

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid6093

--------------------------------------
Status: Verified
Type: Technical

Reported by: Attila Gulyas <toraritte@gmail.com>
Date Reported: 2020-04-12
Verified by: Francesca Palombini (IESG)

Section: 3

Original Text
-------------
   Origin servers SHOULD NOT fold multiple Set-Cookie header fields into
   a single header field.  The usual mechanism for folding HTTP headers
   fields (i.e., as defined in [RFC2616]) might change the semantics of
   the Set-Cookie header field because the %x2C (",") character is used
   by Set-Cookie in a way that conflicts with such folding.

Corrected Text
--------------
   Origin servers SHOULD NOT combine multiple Set-Cookie header fields into 
   a single header field.  The usual mechanism for combining HTTP headers 
   fields (i.e., as defined in [RFC2616]) might change the semantics of 
   the Set-Cookie header field because the %x2C (",") character is used 
   by Set-Cookie in a way that conflicts with such actions.

Notes
-----
RFC 6265 currently uses the verb "folding" when it refers to combining multiple header fields into one, which is ambiguous in the context of the HTTP/1 specs (both by RFC2616 and RFC 7230) where "folding" consistently refers to line folding, and the verb "combine" is used to describe merging same headers. Having a light HTTP knowledge, I naively started looking up "folding" in the HTTP specs, and was immediately confused by the results, others will probably be as well (especially is English is not their native tongue).

Examples to prove this consistency:
+ RFC 2616, Section 4.2, Message Headers, but searching for the for the word "combine" will bring up special cases.
+ RFC 7230, Section 3.2.2, Field Order
+ RFC 2616, Section 2.2, Basic Rules
+ RFC 7230, Section 3.2.4, Field Parsing

Thank you!

--------------------------------------
RFC6265 (draft-ietf-httpstate-cookie-23)
--------------------------------------
Title               : HTTP State Management Mechanism
Publication Date    : April 2011
Author(s)           : A. Barth
Category            : PROPOSED STANDARD
Source              : HTTP State Management Mechanism
Stream              : IETF
Verifying Party     : IESG

[http-state] [Errata Verified] RFC6265 (6093) RFC Errata System