Re: [http-state] draft-ietf-httpstate-cookie-05 posted

[Adam Barth <[e-mail]>]

On Mon, Mar 15, 2010 at 2:54 AM, Yngve N. Pettersen (Developer Opera
Software ASA) <[e-mail]> wrote:
> On Mon, 15 Mar 2010 07:06:40 +0100, Adam Barth <[e-mail]> wrote:
>> On Sun, Mar 14, 2010 at 5:00 PM, Yngve N. Pettersen (Developer Opera
>> Software ASA) <[e-mail]> wrote:
>>>
>>> On Sun, 07 Mar 2010 19:50:57 +0100, Adam Barth <[e-mail]>
>>> wrote:
>>>
>>>> My understanding is that Monday is the deadline for uploading I-Ds
>>>> before IETF77.  I've uploaded the latest version of the draft:
>>>>
>>>> http://www.ietf.org/id/draft-ietf-httpstate-cookie-05.txt
>>>>
>>>> If you're going to IETF77, this is the version of the draft that we'll
>>>> be discussing.  Looking forward to seeing many of you there.
>>>
>>> Yet another possible issue, not sure if it has been mentioned in the
>>> group
>>> before (I have discussed it with others off-list):
>>>
>>> * cookie-name should not be allowed to start with "$". I would prefer a
>>> MUST
>>> NOT, but a SHOULD NOT might be sufficient.
>>
>> Do you mean that servers SHOULD NOT send cookie names that start with
>> $ or are you recommending some conformance requirement for user
>> agents?
>
> Mostly as a server requirement.
>
> Unless the requirement on servers is MUST NOT, it is not possible to add a
> requirement for clients. Although, if there is also text saying that clients
> MAY refuse cookies with names starting with $, that would certainly
> emphasize the point (and would be useful for clients supporting RFC 2965 or
> the proposed $Origin attribute).

We've decided as a general principle that servers ought to be allowed
to use the full protocol specified in Section 5.  That implies we'd
add this requirement as a "SHOULD NOT" for servers.

> RFC 2109 also says about name
>
>      NAMEs that begin with $ are reserved for
>      other uses and must not be used by applications.
>
> Admittedly it is only only using small letters, but maybe it is time to
> strengthen that language?

RFC 2109 says a lot of nonsense.  I'd rather focus on the facts on the
ground when making decisions.

Adam