Re: [http-state] consensus call: cookie server conformance

[Dan Winship <[e-mail]>]

On 01/27/2011 06:06 PM, =JeffH wrote:
>> First, I proposed that we could modify Section 1 as follows:
>>
>>    Compliant servers MUST limit themselves to the well-behaved profile
>>    defined in Section 4 when generating cookies.
>>
>> Second, I proposed that we could then simplify Section 4 as follows:
>>
>>    This section describes the syntax and semantics of a well-behaved
>>    profile of the Cookie and Set-Cookie headers.

-1, because Section 4 says "cookie-value=token", which is annoying
(since it prohibits both base64 and URI encoding, both of which are
commonly used) and unnecessary for interoperability (both existing and
future clients will DTRT with non-token values) and widely violated by
real-world servers that would otherwise be considered well-behaved.

I suppose I could probably be happy with

    cookie-value  = token | base64-string
    base64-string = <a base64 string, defined in [RFC4648], Section 4>

and then change the later Base 16 reference back to Base 64. This still
declares lots of perfectly-interoperable servers "non-compliant", but it
at least provides them with a sane way out.

-- Dan