Re: [http-state] draft-ietf-httpstate-cookie-09 algorithm descriptions

[Adam Barth <[e-mail]>]

On Fri, Jul 16, 2010 at 6:53 PM, Bjoern Hoehrmann <[e-mail]> wrote:
> * Julian Reschke wrote:
>>[Sending one Cookie header is better than sending no Cookie header?]
>
> I agree with what Julian said on that.
>
>>>>>> Also, do we have any evidence that servers actually use UTF-8 here?
>>>>>
>>>>> Nope.
>>>>
>>>> So maybe this statement should be dropped.
>>>
>>> That's been my opinion from the beginning.  However, you'll have to
>>> convince the folks in the working group who advocated for this text to
>>> be added.
>>
>>So please speak up...
>
> We have octets in the Set-Cookie and Cookie headers and we have Unicode
> code points in the `document.cookie` attribute. There needs to be a spe-
> cification how to map between the octets and the code points or one that
> makes that unnecessary or clearly point out that this is undefined.
>
> The other day I used Wireshark to capture all traffic generated when my
> http://cutycapt.sf.net/ tool loaded the Alexa top 1000 web sites, and
> there was not a single instance where non-ASCII octets occured in either
> the Cookie or Set-Cookie header in HTTP messages.

Indeed.  This is the very definition of a tempest in a teapot.

1) This doesn't occur in practice.
2) If it did occur, it would only be observable via an API that is not
contained in this document.
3) If such APIs care, they can define how to translate octets to characters.
4) We give a hint to the folks defining those APIs so they'll
hopefully do something reasonable.

I don't see that there's anything more for us to do here.

Adam