Re: [http-state] One last attempt to get y'all to like the idea of a non-inclusive Set-Cookie design

[Mark Pauley <[e-mail]>]

On Nov 18, 2010, at 1:21 PM, Paul James Hammant wrote:

> So my follow up blog entry isn't suggesting regex (and its 'two
> problems') anymore, it is a comma separated bang (!) prefixed
> expression that looks like the current path concept.
> 
> Also the follow-up blog entry is about pitching the need of mom and
> pop sites who are not going to get into the business of CDNs.
> 
> Lastly, in terms of URLs dynamic resources are nearly always mounted
> at root: examples.com/buyIt?.. rather than in a directory like
> examples.com/dynamic/buyIt  because the end users see this URL (at
> least if they are reasonably technical and gaze up).
> 
> I'm not going to respond to the implicit suggest that the cookie spec
> should be parked broken forever :-P
> 
> Well thanks for listening anyway :)

Totally!  It's just that I have never heard anyone clamoring for this before. 

Most small websites would do better to not set large cookies in general.  A minimal cookie is just a primary key for your session table in the application database.  As Adam mentioned earlier, 12 bytes is probably great for that a session key.  Therefore:

Cookie: s=123456789012

I don't really think it's a big deal compared to the fundamental problems of the cookie protocol / mechanism.  I would rather not spend time spit-polishing a beater here.  Most browsers probably waste more space in their user-agent string than that whole header would require.

_Mark
[e-mail]