[http-state] Ticket 5: Cookie ordering

[Adam Barth <[e-mail]>]

Ticket 3 is still open for discussion, but I'd like to get started
talking the next ticket:
http://trac.tools.ietf.org/wg/httpstate/trac/ticket/5

== Overview ==

Currently the draft defines the order in which cookies should appear
in the Cookie header.  In particular, cookies are ordered first by the
length of the Path attribute (longest first) and then by creation date
(earliest first).  The majority of the most widely used user agents
use this ordering. (I can look up exactly which browsers follow the
ordering if that's important.)

Sending cookies with longer (i.e., more specific) paths first is
important for compatibly because some servers host multiple (mutually
trusting) web applications at different (possibly overlapping) paths.
For example, mail.google.com hosts a public instance of Gmail at
https://mail.google.com/ and corporate instances of Gmail at
https://mail.google.com/a/example.com/.  These web applications expect
their own cookies (with the more specific path) to be presented before
cookies for other web applications (even if the cookies have the same
names).  In fact, this behavior is required by the original Netscape
cookie spec.

== Proposal ==

(1) Continue to specify the ordering.

== Alternatives ==

(2) Do not specify an ordering for cookies in the Cookie header.  This
alternative reduces interoperability between user agents because user
agents that serialize cookies in different orders will operate
different than each other.  As the most popular user agents already
order cookies, user agents with less market share can gain
interoperability by matching the consensus ordering.

(3) Require that cookies with longer paths appear before cookies with
shorter paths, but do not require an ordering among cookies with equal
path lengths.  This approach maximizes user agent flexibility while
meeting the most important compatibility needs, but it's unclear to me
that there is value in maximizing user agent flexibility in this
regard.  It seems like if we're going to specify an ordering for
cookies, we might as well specify the total ordering used by the most
popular user agents.