[http-state] [Errata Rejected] RFC6265 (6719)

RFC Errata System <rfc-editor@rfc-editor.org> Wed, 12 February 2025 11:53 UTC

To: philip@gladstonefamily.net, abarth@eecs.berkeley.edu
From: RFC Errata System <rfc-editor@rfc-editor.org>
Content-Type: text/plain; charset="UTF-8"
Message-Id: <20250212115347.5212A23E262@rfcpa.rfc-editor.org>
Date: Wed, 12 Feb 2025 03:53:47 -0800
Message-ID-Hash: IP45KLQSTIAESF23NYVLYTPUTCU5QDQT
CC: francesca.palombini@ericsson.com, iesg@ietf.org, http-state@ietf.org, rfc-editor@rfc-editor.org
Precedence: list
Subject: [http-state] [Errata Rejected] RFC6265 (6719)
Archived-At: <https://mailarchive.ietf.org/arch/msg/http-state/8aENcGX6Ien2iXYlTNBuzLkX2ig>

The following errata report has been rejected for RFC6265,
"HTTP State Management Mechanism".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid6719

--------------------------------------
Status: Rejected
Type: Technical

Reported by: Philip Gladstone <philip@gladstonefamily.net>
Date Reported: 2021-10-22
Rejected by: Francesca Palombini (IESG)

Section: 4.1.1

Original Text
-------------
max-age-av = "Max-Age=" non-zero-digit *DIGIT

Corrected Text
--------------
max-age-av = "Max-Age=" non-negative-integer
non-negative-integer = zero-digit / (non-zero-digit *DIGIT)
zero-digit = %x30

Notes
-----
In section 5.2.2, there is the following text on the value of the max-age:

> Let delta-seconds be the attribute-value converted to an integer.
>
> If delta-seconds is less than or equal to zero (0), let expiry-time
> be the earliest representable date and time.

If max-age is an integer greater than 0, then the entire sentence is meaningless. It is a common practice to use max-age=0 to expire a cookie immediately. I think that the ABNF is incorrect. However, I don't see any reason to permit negative values.
--VERIFIER NOTES--
User agents and Servers have different requirements and a UA is expected to be able to handle a wider range of inputs than the well-behaved profile for Servers that is defined in Section 4. This erratum is analogous to https://www.rfc-editor.org/errata/eid3430 which was likewise rejected.

--------------------------------------
RFC6265 (draft-ietf-httpstate-cookie-23)
--------------------------------------
Title : HTTP State Management Mechanism
Publication Date : April 2011
Author(s) : A. Barth
Category : PROPOSED STANDARD
Source : HTTP State Management Mechanism
Stream : IETF
Verifying Party : IESG

[http-state] [Errata Rejected] RFC6265 (6719) RFC Errata System