Re: [http-state] parser rules of draft-ietf-httpstate-cookie-22

Adam Barth <ietf@adambarth.com> Thu, 24 February 2011 22:34 UTC

MIME-Version: 1.0
In-Reply-To: <4D66DC31.1020200@gmail.com>
References: <20110204184735.26023.qmail@mm01.prod.mesa1.secureserver.net> <AANLkTinFq7bE_e3SSgdjuFvZ8hGn1xy4Hc1VKwc=vp1D@mail.gmail.com> <49225418-A1AF-4299-8C4F-2E608D34265D@gbiv.com> <AANLkTimrJF3LFR4t4j=U2L33kFh+wf-R=sjjwexcmyPi@mail.gmail.com> <26240DE2-4DD3-4863-81B1-635D34BA4AE4@gbiv.com> <AANLkTikzB=VORtn7xiG2JY8ymTjk4epC9huZTC-s0nzq@mail.gmail.com> <4D5AEE94.6010303@gmx.de> <AANLkTimkmZ99qDcXB6=-PGtXq6WQ7+RSreRwsBAHryEj@mail.gmail.com> <DA7A626A-9613-4A49-8A46-8096F7F465B4@gbiv.com> <AANLkTi=aX26NgDx3J0zk6a6H-Fg-9hyuBhfwvVW5nBiH@mail.gmail.com> <AANLkTinnySHEXvaQSxoUAKNaPWThDWdJwnhvCdVfa5Vr@mail.gmail.com> <1E7DE6DF-864A-48AF-B9A3-698DEF4B3B2D@gbiv.com> <4D6590F4.6010505@stpeter.im> <94DA5CF6-88AB-43BD-99AE-921BCA98C7A3@gbiv.com> <AANLkTikxOBCgiAwvg3z2DwyHtJXhTK1=6ipTo16csKr9@mail.gmail.com> <4D66C718.3000300@stpeter.im> <1CE31B7F-5D95-4CFE-B9A1-FBCC9461E472@gbiv.com> <AANLkTim18Lu-_8+OB_oXyRK_x6aPV++m2=ZgnahNSLvK@mail.gmail.com> <4D66DC31.1020200@gmail.com>
From: Adam Barth <ietf@adambarth.com>
Date: Thu, 24 Feb 2011 14:34:25 -0800
Message-ID: <AANLkTikejL7TRYJVkrCxMHe7SSZD5caLKt+bJwnK1yE+@mail.gmail.com>
To: Dan Winship <dan.winship@gmail.com>
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable
Cc: "Roy T. Fielding" <fielding@gbiv.com>, iesg@iesg.org, http-state <http-state@ietf.org>
Subject: Re: [http-state] parser rules of draft-ietf-httpstate-cookie-22
Precedence: list

On Thu, Feb 24, 2011 at 2:31 PM, Dan Winship <dan.winship@gmail.com> wrote:
> On 02/24/2011 04:50 PM, Adam Barth wrote:
>> DQUOTE is a cargo cult.  Matching DQUOTEs, as above, are less
>> problematic although they do have interoperability problems.  For
>> example, some user agents will incorrectly parse
>>
>> Set-Cookie: foo="bar\"; Secure
>>
>> (allowed by the grammar above) and will not interpret this header as
>> containing a Secure cookie.  If you insist on DQUOTE, we'll probably
>> be better off excluding %x5C from cookie-octet.
>
> I currently have some cookies with \" in them.
>
> Rather than trying to deal with this in the grammar, we could handle it
> like Max-Age, and just add "WARNING: If the cookie-value starts with a
> DQUOTE, some existing user agents will require it to be a valid
> quoted-string."

Those cookies will continue to work fine in user agents that follow
the spec.  However, we shouldn't recommend that servers send those
sorts of cookie values.  They're just causing themselves
interoperability problems.

Adam

Re: [http-state] Is this an omission in the parse… Remy Lebeau
[http-state] Is this an omission in the parser ru… Remy Lebeau
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Remy Lebeau
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Julian Reschke
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Remy Lebeau
Re: [http-state] Is this an omission in the parse… Remy Lebeau
Re: [http-state] Is this an omission in the parse… Remy Lebeau
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Roy T. Fielding
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Remy Lebeau
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Remy Lebeau
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Remy Lebeau
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Peter Saint-Andre
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Peter Saint-Andre
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Roy T. Fielding
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Roy T. Fielding
Re: [http-state] Is this an omission in the parse… Julian Reschke
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Julian Reschke
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Roy T. Fielding
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Remy Lebeau
Re: [http-state] Is this an omission in the parse… Dan Winship
Re: [http-state] Is this an omission in the parse… Remy Lebeau
[http-state] parser rules of draft-ietf-httpstate… Roy T. Fielding
Re: [http-state] parser rules of draft-ietf-https… Peter Saint-Andre
Re: [http-state] parser rules of draft-ietf-https… Roy T. Fielding
Re: [http-state] parser rules of draft-ietf-https… Adam Barth
Re: [http-state] parser rules of draft-ietf-https… Peter Saint-Andre
Re: [http-state] parser rules of draft-ietf-https… Roy T. Fielding
Re: [http-state] parser rules of draft-ietf-https… Remy Lebeau
Re: [http-state] parser rules of draft-ietf-https… Adam Barth
Re: [http-state] parser rules of draft-ietf-https… Roy T. Fielding
Re: [http-state] parser rules of draft-ietf-https… Adam Barth
Re: [http-state] parser rules of draft-ietf-https… Dan Winship
Re: [http-state] parser rules of draft-ietf-https… Adam Barth
Re: [http-state] parser rules of draft-ietf-https… Peter Saint-Andre