Re: [http-state] Ticket 11: Character encoding for non-ASCII cookies values

[Adam Barth <[e-mail]>]

I'm going to close this ticket because no one objected to this resolution.

Adam


On Tue, Mar 2, 2010 at 4:24 PM, Adam Barth <[e-mail]> wrote:
> We had some earlier discussion about what to do with non-ASCII
> characters in cookie values.
>
> == On the wire ==
>
> * IE, Firefox, Chrome, and Opera seem to treat non-ASCII characters as
> opaque octets on the wire
> * Safari seems to drop cookies with non-ASCII characters (although
> Maciej said code inspection leads him to believe Safari's behavior is
> a bit more complicated).
>
> == In document.cookie ==
>
> In <http://github.com/abarth/http-state/blob/master/notes/2010-02-03-Julian-Reschke.txt>,
> Julian Reschke wrote:
> [[
> I just did a quick test with an ISO-8859-1 encoded cookie value,
> client-side javascript and "alert(document.cookie)":
> - IE and Firefox appear to treat the cookie as ISO-8859-1
> - Safari appears to ignore the cookie
> - Chrome and Opera appear to try to decode as UTF-8 (and returns a
> REPLACEMENT CHAR in place of the umlaut I tried)
> ]]
>
> == Proposal ==
>
> The draft treats the cookie values as opaque octets throughout for use
> on the wire.  I've added a SHOULD-level requirement to use a UTF8 when
> converting the octets to characters (e.g., for use in the user agent's
> user interface).
>
> Given that the encoding issue doesn't appear to affect
> interoperability on the wire, I think a SHOULD-level recommendation is
> appropriate here.  If specific APIs (e.g., document.cookie) have more
> specific needs, they can add additional requirements.
>
> Thoughts?
>
> Adam
>