Re: [http-state] Updated draft

[Daniel Stenberg <[e-mail]>]

On Mon, 17 Aug 2009, Dan Winship wrote:

>> I've browsed the Cookie: code for curl, wget, libsoup, pavuk, lftp and
>> aria2. If I didn't miss anything, none of these cookie implementations
>> sort the cookies as the browsers.
>
> You missed this in soup-cookie-jar.c:
>
> 	/* FIXME: sort? */

Actually I didn't. It instead convinced me that libsoup doesn't sort which was 
what I was curious about (and you hadn't mentioned). So I could in no time 
whip up six (6!) HTTP clients that support cookies that don't sort them in the 
Cookie: header. I think taken together they do represent a fair amount of 
current usage.

FIXMEs or TODOs can be fixed in future releases for most software, that 
doesn't really change what is in use today, right now.

> Be liberal in what you accept (clients MUST accept all date formats, servers 
> MUST accept cookies in any order) and conservative in what you send (clients 
> MUST send cookies in the recommended order, servers MUST send dates in the 
> recommended format).

I think that servers MUST accept them in any order, but clients only SHOULD 
send them sorted like that (path len first then creation date).

Uhm, come to think of it on the matter of creation dates: the older 
Firefox/Mozilla/Netscape cookie file format doesn't save the creation dates of 
cookies, only expiration dates. So surely they won't be able to send cookies 
in the correct order after a restart?

-- 

  / daniel.haxx.se