Re: [http-state] draft-ietf-httpstate-cookie-09 algorithm descriptions

[Bjoern Hoehrmann <[e-mail]>]

* Julian Reschke wrote:
>[Sending one Cookie header is better than sending no Cookie header?]

I agree with what Julian said on that.

>>>>> Also, do we have any evidence that servers actually use UTF-8 here?
>>>>
>>>> Nope.
>>>
>>> So maybe this statement should be dropped.
>>
>> That's been my opinion from the beginning.  However, you'll have to
>> convince the folks in the working group who advocated for this text to
>> be added.
>
>So please speak up...

We have octets in the Set-Cookie and Cookie headers and we have Unicode
code points in the `document.cookie` attribute. There needs to be a spe-
cification how to map between the octets and the code points or one that
makes that unnecessary or clearly point out that this is undefined.

The other day I used Wireshark to capture all traffic generated when my
http://cutycapt.sf.net/ tool loaded the Alexa top 1000 web sites, and
there was not a single instance where non-ASCII octets occured in either
the Cookie or Set-Cookie header in HTTP messages.
-- 
Björn Höhrmann · mailto:[e-mail] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: [phone] · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/