Re: [http-state] Comments on draft-ietf-httpstate-cookie-08.txt (4.1.2.2 - 5.2.6)

[Daniel Stenberg <[e-mail]>]

On Fri, 28 May 2010, Bjoern Hoehrmann wrote:

> I doubt the draft should require implementations to use the "last" Date 
> header, there are plenty of HTTP implementations where that is not possible 
> as the headers are only accessible in folded form. Section 4.1.2.1 also 
> should be updated to clearly express that even though the expiry time is set 
> in an absolute form, it'll be handled as relative value, as that is rather 
> surprising.

I agree. I don't think we've discussed this properly on the list. (Or if we 
did I might've missed it.)

Why would the 'expires' attribute be treated relative like 5.2.1 describes? 
Expires is an absolute time, and I don't see why clients shouldn't try to use 
exactly that time in time comparisons. If the server/client clocks are off in 
any significant way, every response-with-cookies without Date: header would 
then be subject to flaws and I expect that a majority of cookie-sending server 
responses are done without Date:

I also would expect that lots of implmentations treat that time as an absolute 
and not a relative unconditionally.

Are the big-5 doing it this way?

-- 

  / daniel.haxx.se