Re: [http-state] [Technical Errata Reported] RFC6265 (3430)

[Dan Winship <[e-mail]>]

On 12/14/2012 09:30 AM, Barry Leiba wrote:
> Actually, it's much worse than that: the ABNF for max-age-av does not
> match the text in Section 5.2.2 at all

Yes, that's intentional, and explained in the introduction:

>    To maximize interoperability with user agents, servers SHOULD limit
>    themselves to the well-behaved profile defined in Section 4 when
>    generating cookies.
> 
>    User agents MUST implement the more liberal processing rules defined
>    in Section 5, in order to maximize interoperability with existing
>    servers that do not conform to the well-behaved profile defined in
>    Section 4.

The prohibition against "Max-Age=0" is probably because IE still doesn't
support Max-Age, so any cookie that has Max-Age but not Expires is a
session cookie in IE. That's annoying for non-zero Max-Age values (and
the spec warns about this), but Max-Age=0 would end up meaning "delete
the cookie unless the user is using IE", which is almost certainly not
what you want.

-- Dan