Re: [http-state] draft-ietf-httpstate-cookie-05 posted

[Adam Barth <[e-mail]>]

On Mon, Mar 15, 2010 at 9:31 AM, Julian Reschke <[e-mail]> wrote:
> On 15.03.2010 17:23, Adam Barth wrote:
>>> We're only supposed to require user agents to do things that are
>>> already widely implemented.  I'll happily add this requirement if user
>>> agents widely implement it, but that's not the case currently.
>>> There's a bunch of stuff in RFC 2109 that's been "reserved" and
>>> "should be reserved" but the reality today is that it isn't reserved.
>>
>> Another perspective is that there's no big rush to add this
>> requirement.  It's probably not going to make user agents change their
>> behavior appreciably faster.  We might as well wait on moving the
>> mountain to phase 2.
>> ...
>
> Don't require user agents to do anything specific. Just state that is has
> been reserved, continues to be reserved, and that servers must not use it.

I agree that we should add a server requirement not to use cookie
names that begin with $.  I think it's more consistent with our
previous decisions to place the requirement at the SHOULD NOT level.
For example, currently Section 4 (which contains the server
requirements) doesn't have any MUST-level requirements.  If we're
going to add MUST-level requirements, then we should ban some of the
more ridiculous parts of the protocol before we ban use of $.

Adam