Re: [http-state] Ticket 11: Character encoding for non-ASCII cookies values

[Adam Barth <[e-mail]>]

On Tue, Mar 2, 2010 at 5:08 PM, Roy T. Fielding <[e-mail]> wrote:
> On Mar 2, 2010, at 4:24 PM, Adam Barth wrote:
>> The draft treats the cookie values as opaque octets throughout for use
>> on the wire.  I've added a SHOULD-level requirement to use a UTF8 when
>> converting the octets to characters (e.g., for use in the user agent's
>> user interface).
>>
>> Given that the encoding issue doesn't appear to affect
>> interoperability on the wire, I think a SHOULD-level recommendation is
>> appropriate here.  If specific APIs (e.g., document.cookie) have more
>> specific needs, they can add additional requirements.
>>
>> Thoughts?
>
> I think that is fine if it is made clear that UTF-8 is only applicable
> after the field value is extracted from the rest of the message.  I.e.,
> the HTTP parser must be ASCII-based and thus not vulnerable to
> invalid Unicode byte sequences.

Hopefully that should be clear in the draft.  The encoding is mention
at the end of the serialization section (which is two sections after
the parsing section).

Adam