[http-state] Intermediate proxy servers and Set-Cookie/Cookie headers

["Rich, Anthony" <[e-mail]>]

Hello,

In RFC 2109 HTTP State Management Mechanism, 4.5  Caching Proxy Role it says:
   Proxies must not introduce Set-Cookie (Cookie) headers of their own
   in proxy responses (requests).

And again in RFC 2965 HTTP State Management Mechanism, 3.5  Caching Proxy Role it says:
   Proxies MUST NOT introduce Set-Cookie2 (Cookie) headers of their own
   in proxy responses (requests).

When examining user-agent log files from one of our clients recently I started noticing HTTP responses like this:
   HTTP/1.1 407 Proxy Authentication Required
   Proxy-Authenticate: NTLM,BASIC realm="W2K"
   Cache-Control: no-cache
   Pragma: no-cache
   Content-Type: text/html; charset=utf-8
   Proxy-Connection: close
   Set-Cookie: BCSI-CS-D0616EFC8C0A61B2=2; Path=/
   Connection: close
   Content-Length: 818

Note that this is coming from an intermediate proxy, not an origin server, and yet it has a Set-Cookie header.

At the moment I am trying to get in contact with the proxy vendor but I wanted to confirm that proxies should not be setting cookies and that there is no RFC being prepared that allows it.

I can see all sorts of issues with this, but the big three for me are:
1. poisoning of origin server cookies (due to name collisons)
2. unintended expulsion of legitimate cookies from user agents' cookie jars (due per domain limits, for example).
3. potential for problems with poorly-implemented applications on origin servers (unexpected cookies that they themselves have not issued). Since there is currently no way for user agents to distinguish between origin server cookies and proxy server cookies user agents would likely send this cookie with every request on this domain and the origin server would see it if the proxy server does not filter it.

Am I being unnecessarily concerned?

Thanks in advance,
Anthony.