Re: [http-state] draft-ietf-httpstate-cookie-05 posted

["Paul E. Jones" <[e-mail]>]

> I wonder if the Expires/Max-age should discourage using values more
> than a
> few years into the future. One thing is that it is unlikely that the
> client will exist as long (but that to the end of client existence
> aspect
> is probably what the designer want); another is that the server will
> have
> to maintain a database for those sessions for a very long time,
> possibly
> leading to a lot of storage overhead; a third is that quite a few
> people
> frown upon the use of long-lasting cookies. Maybe a recommendation of
> "not
> more than" 2 or 3 years should be added as a best-practice?

I think that's a reasonable recommendation, since such cookies waste space
and might be viewed as a privacy concern by some.  We've seen stories about
user outcry over long-lived "tracking" cookies and such.  Perhaps we might
even go a step further and say that the UA may reduce the expiration time as
it sees fit.

Paul