[http-state] [Technical Errata Reported] RFC6265 (7604)

RFC Errata System <rfc-editor@rfc-editor.org> Tue, 15 August 2023 12:30 UTC

To: abarth@eecs.berkeley.edu, superuser@gmail.com, francesca.palombini@ericsson.com, Jeff.Hodges@kingsmountain.com
From: RFC Errata System <rfc-editor@rfc-editor.org>
Cc: tedz2usa@gmail.com, http-state@ietf.org, rfc-editor@rfc-editor.org
Content-Type: text/plain; charset="UTF-8"
Message-Id: <20230815123027.0BD71E7C4C@rfcpa.amsl.com>
Date: Tue, 15 Aug 2023 05:30:27 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/http-state/jmfvelzXOQxw3ybM9BW4-o4XbjM>
Subject: [http-state] [Technical Errata Reported] RFC6265 (7604)
Precedence: list

The following errata report has been submitted for RFC6265,
"HTTP State Management Mechanism".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid7604

--------------------------------------
Type: Technical
Reported by: Ted Zhu <tedz2usa@gmail.com>

Section: 3.  Overview

Original Text
-------------
User agents MAY ignore Set-Cookie headers contained in
responses with 100-level status codes but MUST process Set-Cookie
headers contained in other responses (including responses with 400-
and 500-level status codes).

Corrected Text
--------------
Cookie-enabled user agents MAY ignore Set-Cookie headers contained in
responses with 100-level status codes but MUST process Set-Cookie
headers contained in other responses (including responses with 400-
and 500-level status codes).

Notes
-----
The concern is that the sentence in its original form may be read to mean that all conforming user agents MUST process Set-Cookie headers contained in non 100-level responses, when, differing behavior is allowed as described in sections 5.2 and 7.2:

Section 5.2, paragraph 1: "When a user agent receives a Set-Cookie header field in an HTTP response, the user agent MAY ignore the Set-Cookie header field in its entirety."

Section 7.2, paragraph 2: "When cookies are disabled, ... the user agent MUST NOT process Set-Cookie headers in inbound HTTP responses."

The suggested correction is one possible way to alleviate this erratum concern. However, the erratum author does not know if this is the most optimal disambiguation method.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC6265 (draft-ietf-httpstate-cookie-23)
--------------------------------------
Title               : HTTP State Management Mechanism
Publication Date    : April 2011
Author(s)           : A. Barth
Category            : PROPOSED STANDARD
Source              : HTTP State Management Mechanism
Area                : Applications
Stream              : IETF
Verifying Party     : IESG

[http-state] [Technical Errata Reported] RFC6265 … RFC Errata System