Re: [http-state] Support of nameless cookies by user agents

[Maciej Stachowiak <[e-mail]>]

On Dec 15, 2009, at 10:45 PM, Maciej Stachowiak wrote:

>
> On Dec 15, 2009, at 10:34 PM, Adam Barth wrote:
>
>> I'd like to apologize to Roy.  I was mistaken about which user agents
>> support nameless cookies.  That was one of the first tests I wrote  
>> and
>> I misremembered the results.  Here's the compatibility matrix:
>>
>> Test 004: Set-Cookie: foo
>>
>> IE8, Firefox, Chrome: Cookie: foo
>> Safari, cURL: (no header)
>> Opera: Cookie: foo=
>>
>> I've added a TODO to the draft.
>
>
> This agrees with my testing. And from script (not fully relevant to  
> the protocol, but perhaps of interest), document.cookie="foo"  
> creates a cookie named "foo" with an empty value, rather than a  
> nameless cookie, while document.cookie="" does nothing, so we would  
> have been hit by the Mozilla bankofamerica bug cited earlier.

Side note: here is the bug where we added support for cookies without  
an = sign, implementing them as valueless rather than nameless,  
working around the lower level library:

https://bugs.webkit.org/show_bug.cgi?id=6531

The nature of the workaround means that cookies with no equal sign are  
only supported in script, not on the wire, but if you set one in  
script it will get sent in outgoing Cookie headers.

We have an internal bug to track adding support at the protocol level.

I was not able to find a bug (either in the bug system or internal)  
that could be readily identified as needing nameless cookies to be  
treated nameless instead of valueless. However, it is possible we have  
a site compatibility bug that is in fact about that issue, but no one  
has yet diagnosed it.

Regards,
Maciej