Re: [http-state] Updated draft

[Daniel Stenberg <[e-mail]>]

On Mon, 17 Aug 2009, Adam Barth wrote:

> You're exactly right that servers are extremely fragile, especially with 
> regards to the cookie header.  However, they won't break due to variations 
> in sort order issues because all the major browsers use the same sort order!

If the path names aren't of identical lengths, yes. But Safari does it 
differently if they are - if I understood your mail correctly. And lots of 
cookies are bound to have the same path lengths.

> There's a clear cost to not specifying the sort order: new implementations 
> that follow the spec will behave differently than all the major browsers. 
> However, you haven't articulated a reason why we ought not to specify the 
> sort order.

My reason is quite simply because lots of existing "cookie clients" and 
"cookie servers" have no sorting at all. By saying sorting is necessary for 
cookie compliance, lots of client implementations are thus effectively made 
broken.

This for an effect very few sites care about to the extent that I wasn't even 
aware of it until just a few days ago. I would MUCH rather that we claim those 
few rare server sides non-compliant. We would then have a section explaining 
that some broken sites would in the past depend on this sorted behavior that 
no spec ever mandated.

I would claim that the share of HTTP clients that don't sort (this way) is 
larger than the share of HTTP sites that insist on cookies being sorted. But I 
don't have any numbers to back this up.

But I'll drop this subject for now.

-- 

  / daniel.haxx.se