Re: [http-state] Ticket 5: Cookie ordering

[Adam Barth <[e-mail]>]

Would you be willing to share your test cases?  I'd like to add them
to the test suite.

Thanks,
Adam


On Mon, Feb 8, 2010 at 8:19 AM, Yngve Nysaeter Pettersen
<[e-mail]> wrote:
> On Fri, 05 Feb 2010 13:56:58 +0100, Yngve Nysaeter Pettersen
> <[e-mail]> wrote:
>>
>> IOW, if ordering is determined by anything but the domain and path the
>> sequence of cookie is going to vary depending on which servers the clients
>> visits and the sequence it visits them, and this might cause significant
>> problems for a server that considers ordering significant.
>
> Some testing by a couple of my colleagues setting two cookies with the same
> name (and path) "host-only" and "domain-wide" have found the following in
> browsers other than Opera:
>
> -----
> Visit order: Host-only, domain-wide
> Cookie order:  "host-only", "domain-wide"
> -----
>
> -----
> Visit order: domain-wide, Host-only
> Cookie order (IE):  "host-only", "domain-wide"
> Cookie order (Others): "domain-wide", "host-only"
> -----
>
> To me it looks like IE is sorting by domain, at the same path level, with FF
> and Safari (the two tested) sort on creation data.
>
> The consequence is that there is apparently three deployed ways to send
> cookies:
>
>   - Cookies at the same path level are grouped and sorted by creation date,
> earliest first (FF&co)
>   - Cookies at the same path level are grouped and sorted by domain, most
> specific first (IE)
>   - Cookies are grouped by domain (most specific first), then sorted by path
> (most specific first) within each domain (Opera)
>
> IMO the creation date method is less predictable than the other two, and
> will cause problems for sites depending on a specific sequence of cookies.
>
> My suggestion would be that the spec should recommend ordering an ordering
> based on on both domain and path (order of preference to be decided), as
> that will be more predictable for sites using multiple cookies with the same
> name at various domain and path levels.
>
> --
> Sincerely,
> Yngve N. Pettersen
> ********************************************************************
> Senior Developer                     Email: [e-mail]
> Opera Software ASA                   http://www.opera.com/
> Phone:  [phone]              Fax:    [phone]
> ********************************************************************
> _______________________________________________
> http-state mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/http-state
>