Re: [http-state] Updated draft

[Adam Barth <[e-mail]>]

On Mon, Aug 17, 2009 at 10:40 AM, Daniel Stenberg<[e-mail]> wrote:
> My reason is quite simply because lots of existing "cookie clients" and
> "cookie servers" have no sorting at all. By saying sorting is necessary for
> cookie compliance, lots of client implementations are thus effectively made
> broken.

I don't see why that matters.  I can sit in my basement and write 1000
cookie implementations that no one uses and it doesn't matter whether
we declare them non-compliant.

> This for an effect very few sites care about to the extent that I wasn't
> even aware of it until just a few days ago. I would MUCH rather that we
> claim those few rare server sides non-compliant. We would then have a
> section explaining that some broken sites would in the past depend on this
> sorted behavior that no spec ever mandated.

These site are non-complaint.  We're discussing the user agent
conformance section.  User agents need to know how to deal with broken
sites in an interoperable manner.

If you like, we can add a requirement to the server conformance
section admonishing servers not to depend on this behavior.

> I would claim that the share of HTTP clients that don't sort (this way) is
> larger than the share of HTTP sites that insist on cookies being sorted. But
> I don't have any numbers to back this up.

Comparing those quantities is irrelevant.

> But I'll drop this subject for now.

Ok.

Adam