[http-state] test data question

Vasiliy Baranov <vasiliy.baranov@oracle.com> Tue, 22 November 2011 16:15 UTC

Return-Path: <vasiliy.baranov@oracle.com>
X-Original-To: http-state@ietfa.amsl.com
Delivered-To: http-state@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4DE4421F8C74 for <http-state@ietfa.amsl.com>; Tue, 22 Nov 2011 08:15:48 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.599
X-Spam-Level:
X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sRW5iKspSS5Q for <http-state@ietfa.amsl.com>; Tue, 22 Nov 2011 08:15:47 -0800 (PST)
Received: from acsinet15.oracle.com (acsinet15.oracle.com [141.146.126.227]) by ietfa.amsl.com (Postfix) with ESMTP id C624A1F0CC6 for <http-state@ietf.org>; Tue, 22 Nov 2011 08:14:45 -0800 (PST)
Received: from acsinet21.oracle.com (acsinet21.oracle.com [141.146.126.237]) by acsinet15.oracle.com (Switch-3.4.4/Switch-3.4.4) with ESMTP id pAMGEh23000874 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for <http-state@ietf.org>; Tue, 22 Nov 2011 16:14:44 GMT
Received: from acsmt358.oracle.com (acsmt358.oracle.com [141.146.40.158]) by acsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id pAMGEhck002317 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for <http-state@ietf.org>; Tue, 22 Nov 2011 16:14:43 GMT
Received: from abhmt114.oracle.com (abhmt114.oracle.com [141.146.116.66]) by acsmt358.oracle.com (8.12.11.20060308/8.12.11) with ESMTP id pAMGEbb9026960 for <http-state@ietf.org>; Tue, 22 Nov 2011 10:14:37 -0600
Received: from [10.162.83.149] (/10.162.83.149) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 22 Nov 2011 08:14:37 -0800
Message-ID: <4ECBCA44.2020800@oracle.com>
Date: Tue, 22 Nov 2011 20:13:56 +0400
From: Vasiliy Baranov <vasiliy.baranov@oracle.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.20) Gecko/20110804 Thunderbird/3.1.12
MIME-Version: 1.0
To: http-state@ietf.org
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
X-Source-IP: acsinet21.oracle.com [141.146.126.237]
X-Auth-Type: Internal IP
X-CT-RefId: str=0001.0A090201.4ECBCA74.00B4,ss=1,re=0.000,fgs=0
Subject: [http-state] test data question
X-BeenThere: http-state@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Discuss HTTP State Management Mechanism <http-state.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/http-state>, <mailto:http-state-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/http-state>
List-Post: <mailto:http-state@ietf.org>
List-Help: <mailto:http-state-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/http-state>, <mailto:http-state-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Nov 2011 16:17:44 -0000

Hello,

I have a cookie implementation that attempts to follow RFC 6265. If I 
run it against the test data found in 
https://github.com/abarth/http-state, the following test fails:

     tests/data/parser/name0032-test:

         Set-Cookie: "foo\"bar;baz"=qux


     tests/data/parser/name0032-expected:

         Set-Cookie: "foo\"bar


I am by no means an expert in this area but it seems to me this test 
goes against the spec, in particular, the following statement found in 
RFC 6265 on page 17:

    2.  If the name-value-pair string lacks a %x3D ("=") character,
        ignore the set-cookie-string entirely.


My understanding is, for the test in question the name-value-pair is 
'"foo\"bar'. This name-value-pair obviously lacks the "=" character, so 
my reading of the spec is the cookie should be rejected entirely. The 
test, however, expects the cookie to be accepted and sent back to the 
server on the subsequent request. Does that mean my reading of the spec 
is incorrect?

I tried this test in Chrome 16.0.912.41 beta-m, Firefox 6.0.1, IE 8, and 
Safari 5.0.5. It passes everywhere except for Safari and my poor 
implementation.

Thanks,
-- Vasiliy