Re: [http-state] Ticket 5: Cookie ordering

["Yngve Nysaeter Pettersen" <[e-mail]>]

On Fri, 05 Feb 2010 13:56:58 +0100, Yngve Nysaeter Pettersen  
<[e-mail]> wrote:
> IOW, if ordering is determined by anything but the domain and path the  
> sequence of cookie is going to vary depending on which servers the  
> clients visits and the sequence it visits them, and this might cause  
> significant problems for a server that considers ordering significant.

Some testing by a couple of my colleagues setting two cookies with the  
same name (and path) "host-only" and "domain-wide" have found the  
following in browsers other than Opera:

-----
Visit order: Host-only, domain-wide
Cookie order:  "host-only", "domain-wide"
-----

-----
Visit order: domain-wide, Host-only
Cookie order (IE):  "host-only", "domain-wide"
Cookie order (Others): "domain-wide", "host-only"
-----

To me it looks like IE is sorting by domain, at the same path level, with  
FF and Safari (the two tested) sort on creation data.

The consequence is that there is apparently three deployed ways to send  
cookies:

    - Cookies at the same path level are grouped and sorted by creation  
date, earliest first (FF&co)
    - Cookies at the same path level are grouped and sorted by domain, most  
specific first (IE)
    - Cookies are grouped by domain (most specific first), then sorted by  
path (most specific first) within each domain (Opera)

IMO the creation date method is less predictable than the other two, and  
will cause problems for sites depending on a specific sequence of cookies.

My suggestion would be that the spec should recommend ordering an ordering  
based on on both domain and path (order of preference to be decided), as  
that will be more predictable for sites using multiple cookies with the  
same name at various domain and path levels.

-- 
Sincerely,
Yngve N. Pettersen
********************************************************************
Senior Developer		     Email: [e-mail]
Opera Software ASA                   http://www.opera.com/
Phone:  [phone]              Fax:    [phone]
********************************************************************