Re: [http-state] Make draft-abarth-cookie-06 a working group item?

[Daniel Stenberg <[e-mail]>]

On Fri, 11 Dec 2009, Adam Barth wrote:

> Is this text clearer?
>
> NOTE: If the server supplies Set-Cookie headers that conform to the grammar 
> in this section, then the user agent will return a Cookie header that 
> conforms to the grammar above.  However, if the user agent receives a 
> Set-Cookie header that deviates from the grammar in this section, the 
> requirements in the next section might cause the user agent to return a 
> Cookie header that deviates from the preceding grammar.

They way I read this is still like this:

If a server violates the spec and sends something that isn't a valid cookie, 
the server should expect that the client *too* may violate the spec and send 
something non-conformant back.

... and I have trouble accepting that we include in the spec that server may 
or will violate the spec and it even seems to say that a client is then fine 
to accept such illegal cookies and continue as if they were valid and even 
send them back in subsequent requests!

Invalid headers are wrong, they should be treated as protocol errors and the 
world will be a much better place if clients IGNORE such cookies instead of 
trying hard to obey.

If invalid headers are so common that we need to document them especially, 
then we must change the spec so that they are in fact valid instead as we are 
here to document existing practises and not an imaginary protocol that isn't 
in fact used by most implementations.

-- 

  / daniel.haxx.se