Re: [http-state] Make draft-abarth-cookie-06 a working group item?

["Yngve N. Pettersen (Developer Opera Software ASA)" <[e-mail]>]

On Sat, 12 Dec 2009 17:05:22 +0100, Dan Winship <[e-mail]>  
wrote:

> On 12/11/2009 06:48 PM, Daniel Stenberg wrote:
>> Max-age is now specified to be:
>>
>>       The value of the Max-Age attribute represents the maximum
>>       lifetime of the cookie, measured in seconds from the moment the
>>       user agent receives the cookie
>>
>> RFC2109 and 2965 that both include max-age defined Max-age to be:
>>
>>       The Max-Age attribute defines the lifetime of the cookie, in  
>> seconds.
>>
>> ... with no mention of exactly when the cookie's birth is. I figure we
>> can define it to be since the receive moment for convenience if nothing
>> else. Counting from the sending moment would be hard, even if I bet most
>> server side implementations basically assumes it is from the moment they
>> send the cookie.
>
> For the "max-age" Cache-Control directive, you count from the time in
> the Date header. We could do the same (though we need to put something
> about what to do if there's no Date header).

There is a difference between max-age in Cache-control and max-age in  
Set-Cookie: a response using max-age in Cache-Control can be cached for  
extensive periods before it is returned in response to a client request;  
that is unlikely to be the case for responses with Set-Cookie headers, and  
if it does happen, the time difference is unlikely to cause any major  
issues.


-- 
Sincerely,
Yngve N. Pettersen
 
********************************************************************
Senior Developer                     Email: [e-mail]
Opera Software ASA                   http://www.opera.com/
Phone:  [phone]              Fax:    [phone]
********************************************************************