Re: [http-state] test data question

[Adam Barth <[e-mail]>]

Thanks for the report.  This is an error in the test suite, which I'll fix.

The test is from an older version of the spec that allowed "valueless"
cookies.  The working group decided to remove the concept of valueless
cookies (we can look up the tracker number if you want to see exactly
why).

Thanks again,
Adam


On Tue, Nov 22, 2011 at 8:13 AM, Vasiliy Baranov
<[e-mail]> wrote:
> Hello,
>
> I have a cookie implementation that attempts to follow RFC 6265. If I run it
> against the test data found in https://github.com/abarth/http-state, the
> following test fails:
>
>    tests/data/parser/name0032-test:
>
>        Set-Cookie: "foo\"bar;baz"=qux
>
>
>    tests/data/parser/name0032-expected:
>
>        Set-Cookie: "foo\"bar
>
>
> I am by no means an expert in this area but it seems to me this test goes
> against the spec, in particular, the following statement found in RFC 6265
> on page 17:
>
>   2.  If the name-value-pair string lacks a %x3D ("=") character,
>       ignore the set-cookie-string entirely.
>
>
> My understanding is, for the test in question the name-value-pair is
> '"foo\"bar'. This name-value-pair obviously lacks the "=" character, so my
> reading of the spec is the cookie should be rejected entirely. The test,
> however, expects the cookie to be accepted and sent back to the server on
> the subsequent request. Does that mean my reading of the spec is incorrect?
>
> I tried this test in Chrome 16.0.912.41 beta-m, Firefox 6.0.1, IE 8, and
> Safari 5.0.5. It passes everywhere except for Safari and my poor
> implementation.
>
> Thanks,
> -- Vasiliy
> _______________________________________________
> http-state mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/http-state
>