Re: [http-state] Ticket 5: Cookie ordering

["Yngve Nysaeter Pettersen" <[e-mail]>]

On Fri, 05 Feb 2010 10:59:09 +0100, Daniel Stenberg <[e-mail]> wrote:

>> AFAIK it will not be possible to define an inter-operable domain  
>> ordering specification, so instead the specfication should say that  
>> servers must not rely on a specific ordering for cookies with the same  
>> name set for different domains and the same path (The path  
>> specification means that it is perhaps possible to rely on it for same  
>> name cookies with different name, even for different domains).
>
> Not only that. Your way even makes sure servers can't unconditionally  
> assume the order of cookies with different path lengths, as they must  
> first take into account if the cookies have different domains or not.
>
> I think the spec need to say something about this, if nothing else in an  
> explanatory way as to why or how different clients may send cookies.
>
> All this cookie ordering taken into account, I think a wise  
> recommendation in the spec might be to just advice that cookies using  
> the same name with different paths or domains are simply not a good idea  
> to use at all if you want to inter-operate.

There is also the issue that if ordering, even at the domain level is not  
specified, then there will be problems if a server treats ordering as  
significant, such as only checking the first cookie with the name it is  
looking for.

If we call this server bar.example.com, and assumes it is looking for and  
sets the cookie MyCookie=bar for the host itself (no domain), and we also  
have a server foo.example.com that sets MyCookie=foo for the domain  
.example.com the following can occur if ordering is that first received  
cookie is first in line

If the client visits bar.example.com first, then foo.example.com, order by  
creation date will produce the MyCookie sequence "bar, foo", if  
foo.example.com is visited first then the sequence will be "foo, bar". In  
the latter case bar.example.com will not find its cookie, and may  
repeatedly try to set it. Any update of the cookie (unless original  
creation date is preserved) will move the newest cookie to the last  
position in the list.

If the ordering is most recently set/updated the sequences would be  
reversed (bar first gives "foo, bar", foo first gives "bar, foo"), and the  
bar server would run into problems on the first access after the client  
visited foo, but that would be fixed with sending a new cookie, but the  
session would be lost.

In Opera the sequence would always be "bar,foo" since the foo cookie is  
set for the parent domain which is listed later.

IOW, if ordering is determined by anything but the domain and path the  
sequence of cookie is going to vary depending on which servers the clients  
visits and the sequence it visits them, and this might cause significant  
problems for a server that considers ordering significant.



-- 
Sincerely,
Yngve N. Pettersen
********************************************************************
Senior Developer		     Email: [e-mail]
Opera Software ASA                   http://www.opera.com/
Phone:  [phone]              Fax:    [phone]
********************************************************************