Re: [http-state] Updated draft

[Adam Barth <[e-mail]>]

On Sun, Aug 16, 2009 at 11:10 AM, Daniel Stenberg<[e-mail]> wrote:
> I beg to differ.

Which sorting requirement do you find problematic?  Let's consider the
path-length sorting first.

> First, this sorting was not in the Netscape cookie spec but is only found in
> RFC2109 and RFC2965.

I don't think that should be a factor in our decisions.  Our first
consideration should be the behavior of existing implementations (both
client and server).

> Then, since clearly user agents that don't do any sorting of the cookies can
> play fine against the vast majority of all sites

User agents comprising >99% of the market share implement path-length
sorting.  The only implementation I'm aware of that does not perform
path-length sorting is CURL.  Are there other implementations we
should factor into our decisions?

I suspect that Internet Explorer, Firefox, Safari, Chrome, and Opera
have collectively been tested on more web sites than CURL.  When 5 out
of 5 major browsers agree, there's likely a reason.

> this seems like a
> client-side invention that have no particular meaning to existing servers.
> So by specifying the sort order you not only make a lot of client code
> "non-compliant" all of a sudden,

I don't think it matters how much code we make non-compliant.  We
should weigh the importance of implementations by market share.  In
this case, we have >99% of the market share in favor of path-length
sorting.

> I think you're also over-specifying
> something that doesn't need to be specified.

Here's the test I think we should use when deciding whether to add a
user agent conformance requirement:

"If I were going to implement a new user agent today and I wanted to
maximize compatibility, would I implement this requirement?"

In this case, it's clear that I would want to implement a behavior
that matches all of the major browsers.

> As far as I can understand, it could only really have a meaning if more than
> 50 (or so) cookies are stored for a domain as then the sort order would
> decide which cookies to discard (or rather not include in the Cookie:
> header). But that won't have to imply that the 50 cookies that ARE sent have
> to be sent in this sorted order.

This is not the case.  The priority order for evicting cookies is
different from the order in which cookies appear in the Cookie header
(which is what we're discussing).  You can see that the tests cases
we're using to probe this behavior involve only two cookies each:

0015
0016
path0001
path0002
path0003
path0004

Adam