Re: [http-state] consensus call: cookie server conformance

[Adam Barth <[e-mail]>]

On Sat, Jan 29, 2011 at 2:13 PM, Daniel Stenberg <[e-mail]> wrote:
> On Sat, 29 Jan 2011, Adam Barth wrote:
>>> I hadn't really considered these details about 'token' there and I agree
>>> that it seems a bit too strict.
>>
>> That rule comes from RFC 2109 (with the bogus parts of the RFC 2109
>> cookie-value syntax removed).  It's certainly stricter than we need.
>> Something like allowing base64 sounds reasonable to me.
>
> As a little comparison, my parser (that seems to work with a vast majority
> of all sites) simply allows anything except ; and = in a cookie name, and
> everything except ; and \r and \n in cookie contents.
>
> Of course that doesn't really say that servers will use all those letters,
> only that a receiving end really has little reason to make it more strict
> than this.

I'd have to check the details, but I suspect that agrees with the user
agent requirements for the current draft, although there might be some
subtitles w.r.t. whitespace handling.

That said, I wouldn't recommend that servers make use of that full
flexibility.  For example, sending unpaired UTF-16 surrogates,
malformed UTF-8 sequences, or null characters is probably not a good
idea.

The question boils down what's sensible for servers to send.  IMHO,
token + base64 is reasonable, but I don't feel that strongly about it.

Adam