Re: [http-state] Is this an omission in the parser rules of draft-ietf-httpstate-cookie-21?

Adam Barth <ietf@adambarth.com> Fri, 04 February 2011 08:29 UTC

MIME-Version: 1.0
In-Reply-To: <4D4BB8B6.5070009@gmx.de>
References: <20110203195457.f00013ceab8fb1928885c5c172fbfd4a.d7bc172fae.wbe@email00.secureserver.net> <AANLkTim1rSdg_JmWhEihJROmN+uZABFcPtH-Ngup0WHF@mail.gmail.com> <4D4BB8B6.5070009@gmx.de>
From: Adam Barth <ietf@adambarth.com>
Date: Fri, 04 Feb 2011 00:32:03 -0800
Message-ID: <AANLkTikQBoz1pA2Oa73AziXhyuQ7b6OCN65-pd=VyApC@mail.gmail.com>
To: Julian Reschke <julian.reschke@gmx.de>
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable
Cc: http-state@ietf.org
Subject: Re: [http-state] Is this an omission in the parser rules of draft-ietf-httpstate-cookie-21?
Precedence: list

On Fri, Feb 4, 2011 at 12:28 AM, Julian Reschke <julian.reschke@gmx.de> wrote:
> On 04.02.2011 04:12, Adam Barth wrote:
>>
>> On Thu, Feb 3, 2011 at 6:54 PM, Remy Lebeau<remy@lebeausoftware.org>
>>  wrote:
>>>
>>> -------- Original Message --------
>>> Subject: Re: [http-state] Is this an omission in the parser rules of
>>> draft-ietf-httpstate-cookie-21?
>>> From: Adam Barth<ietf@adambarth.com>
>>> Date: Thu, February 03, 2011 12:18 pm
>>> To: Remy Lebeau<remy@lebeausoftware.org>
>>> Cc: http-state@ietf.org
>>>
>>>> It's not an omission.  The use of quotation mark for cookie values in
>>>> RFC 2109 do not reflect how cookie behave in actual use.
>>>
>>> Just a minute ago, while logging in to Yahoo webmail, I noticed the
>>> server issue a cookie that uses quotations, and my IE 8 webbrowser sent
>>> back 3 cookies that used quotations.  See below.  Quotes in cookies are
>>> a real-world possibility, so the draft should allow for their presence,
>>> at least for user agents that parse cookies, if not in origin servers
>>> that generate them.
>>
>> I should be more clear.  Quotation marks are not special characters in
>> cookie values.  They have no effect on how cookies are processed.  Any
>> use of quotation marks by servers is pure superstition, just like
>> using a leading "." before the value of the Domain attribute.
>
>> ...
>
> Which leaves us with two questions:
>
> 1) Should they be allowed by the grammar in Section 4?

There's some discussion earlier on this list about changing the
grammar for cookie-value to include the base64 characters.  IMHO,
that's vastly more useful than pretending like quote marks mean
anything in this context.

> 2) This is a normative change. Shouldn't there be a section that explains
> what the normative differences compared to 2109 are?

We haven't done that for any of the other "changes" since 2109.  IMHO,
we'll lead happier lives if we act as if 2109 never existed.

Adam

Re: [http-state] Is this an omission in the parse… Remy Lebeau
[http-state] Is this an omission in the parser ru… Remy Lebeau
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Remy Lebeau
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Julian Reschke
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Remy Lebeau
Re: [http-state] Is this an omission in the parse… Remy Lebeau
Re: [http-state] Is this an omission in the parse… Remy Lebeau
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Roy T. Fielding
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Remy Lebeau
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Remy Lebeau
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Remy Lebeau
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Peter Saint-Andre
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Peter Saint-Andre
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Roy T. Fielding
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Roy T. Fielding
Re: [http-state] Is this an omission in the parse… Julian Reschke
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Julian Reschke
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Roy T. Fielding
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Adam Barth
Re: [http-state] Is this an omission in the parse… Remy Lebeau
Re: [http-state] Is this an omission in the parse… Dan Winship
Re: [http-state] Is this an omission in the parse… Remy Lebeau
[http-state] parser rules of draft-ietf-httpstate… Roy T. Fielding
Re: [http-state] parser rules of draft-ietf-https… Peter Saint-Andre
Re: [http-state] parser rules of draft-ietf-https… Roy T. Fielding
Re: [http-state] parser rules of draft-ietf-https… Adam Barth
Re: [http-state] parser rules of draft-ietf-https… Peter Saint-Andre
Re: [http-state] parser rules of draft-ietf-https… Roy T. Fielding
Re: [http-state] parser rules of draft-ietf-https… Remy Lebeau
Re: [http-state] parser rules of draft-ietf-https… Adam Barth
Re: [http-state] parser rules of draft-ietf-https… Roy T. Fielding
Re: [http-state] parser rules of draft-ietf-https… Adam Barth
Re: [http-state] parser rules of draft-ietf-https… Dan Winship
Re: [http-state] parser rules of draft-ietf-https… Adam Barth
Re: [http-state] parser rules of draft-ietf-https… Peter Saint-Andre