[http-state] cookie server conformance

[Peter Saint-Andre <[e-mail]>]

During IESG review, Robert Sparks posted the following DISCUSS regarding
draft-ietf-httpstate-cookie:

   In 4.1.1 (Syntax) - Why is the specification part of this proposed
   standard allowing implementations to  violate the grammar defined by
   this standard? The SHOULD NOT in the first paragraph of this section
   must be a MUST NOT. If the intent is to make sure clients are
   liberal in what they accept because existing servers may generate
   non-conformant grammar, just say that (and if possible, point to
   what they might need to expect). If the intent is to allow servers
   that are compliant to generate messages not covered by this grammar,
   then the grammar is incorrect. If that's the case, the grammar
   should be extended to  allow the alternate behavior and the
   document's prose can say that servers SHOULD NOT use those parts of
   the grammar.

We've had some discussion between Robert, Adam, Jeff, and me to clarify
Robert's concerns. In essence, Robert is concerned that it's merely
implicit that a compliant server MUST NOT generate cookies that don't
conform to the well-behaved profile defined in Section 4. He derives
this conclusion from two pieces of evidence...

First, Section 1 of verson -21 states:

   To maximize interoperability with user agents, servers SHOULD limit
   themselves to the well-behaved profile defined in Section 4 when
   generating cookies.

Second, Section 4 states:

   Servers SHOULD NOT send Set-Cookie headers that fail to conform to
   the following grammar:

Therefore, we can conclude that if a server sends a Set-Cookie header
that violates the grammar, then it is non-conforming. However, we don't
come right out and say that.

To address Robert's concern and to make the constraints more explicit
(it's often problematic to let such things remain implicit), in the
off-list thread with Robert I formulated some proposed text, which I'd
like to share with the working group...

First, I proposed that we could modify Section 1 as follows:

   Compliant servers MUST limit themselves to the well-behaved profile
   defined in Section 4 when generating cookies.

Second, I proposed that we could then simplify Section 4 as follows:

   This section describes the syntax and semantics of a well-behaved
   profile of the Cookie and Set-Cookie headers.

I think that's a bit cleaner because it's not subject to as much
interpretation. However, the change from SHOULD to MUST is not
insignificant, so I think it's something that the working group needs to
discuss.

Your feedback is welcome.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/