Re: [http-state] [Technical Errata Reported] RFC6265 (3430)

[Zhong Yu <[e-mail]>]

On Mon, Dec 17, 2012 at 9:58 AM, Dan Winship <[e-mail]> wrote:
> On 12/14/2012 09:30 AM, Barry Leiba wrote:
>> Actually, it's much worse than that: the ABNF for max-age-av does not
>> match the text in Section 5.2.2 at all
>
> Yes, that's intentional, and explained in the introduction:
>
>>    To maximize interoperability with user agents, servers SHOULD limit
>>    themselves to the well-behaved profile defined in Section 4 when
>>    generating cookies.
>>
>>    User agents MUST implement the more liberal processing rules defined
>>    in Section 5, in order to maximize interoperability with existing
>>    servers that do not conform to the well-behaved profile defined in
>>    Section 4.
>
> The prohibition against "Max-Age=0" is probably because IE still doesn't
> support Max-Age, so any cookie that has Max-Age but not Expires is a
> session cookie in IE. That's annoying for non-zero Max-Age values (and
> the spec warns about this), but Max-Age=0 would end up meaning "delete
> the cookie unless the user is using IE", which is almost certainly not
> what you want.

Thanks Dan, so a server should avoid Max-Age all together. If a server
sets Max-Age=a few seconds, it won't be honored by IE either.

Zhong