Re: [http-state] I-D Action:draft-ietf-httpstate-cookie-03.txt

[Achim Hoffmann <[e-mail]>]

Hi Adam,

Julian already gave the answer:
  dates from the server MUST be in rfc1123 format
  the browser MAY accept other formats

So I don't have concerns.
Thanks for clarifying.

Achim

Adam Barth wrote on 23.02.2010 07:32:
> On Mon, Feb 22, 2010 at 10:11 AM, Achim Hoffmann <[e-mail]> wrote:
>> Simple question about the *dates" in this draft:
>>
>> 1) If I understand 5.1.1. Dates correctly, the format of the date is
>>   fixed and must be in GMT.
>>   IIRC the date format in RFC2616 allows more variants. Also the timezone
>>   may be different to GMT (see RFC2616, 19.3).
>>
>>   So the definitions in this draft would brake old behaviours.
>>   (Though, from a security point of view, I'd prefer the draft definition:)
> 
> The date format in 5.1.1. is specifically constructed to avoid
> breaking legacy servers.  Is your concern based on a specific legacy
> server or general philosophy?
> 
>> 2) In 4.1.2. Semantics (third paragraph) we read:
>>        " .. by including an Expires attribute with a value in the past."
>>   This is a bit missleading unless all date formats are GMT (see 1) above).
> 
> This section is non-normative.  If the server behaves as recommended
> (e.g., uses rfc1123-date), then this advice is sensible.
> 
> Adam
>