Re: [http-state] [Technical Errata Reported] RFC6265 (3663)

[Dave Thaler <[e-mail]>]

Thanks Bjoern.

Interesting, well in that case there may be an issue in the RFC 6265 algorithm for path matching.  
That's because it requires comparison for "identical" and "ab", "AB", "aB", and "Ab" are not "identical".

So 
http://www.example.com/%AB/foo
http://www.example.com/%ab/foo
http://www.example.com/%Ab/foo
http://www.example.com/%aB/foo

are all "equivalent" in the language of RFC 3986, but not "identical" and hence a cookie on one will not match the others.

It may still be worth having an errata noting the above issue, even if it's Hold For Document Update.

-Dave

-----Original Message-----
From: Bjoern Hoehrmann [mailto:[e-mail]] 
Sent: Monday, June 17, 2013 5:36 PM
To: RFC Errata System
Cc: [e-mail]; [e-mail]; [e-mail]; [e-mail]; Dave Thaler; [e-mail]
Subject: Re: [http-state] [Technical Errata Reported] RFC6265 (3663)

* RFC Errata System wrote:
>Notes
>-----
>HEXDIG is defined in [RFC5234], Appendix B.1 as
>  HEXDIG         =  DIGIT / "A" / "B" / "C" / "D" / "E" / "F"
>Note that lower case a-f are not legal.

As per RFC 5234:

   NOTE:

      ABNF strings are case insensitive and the character set for these
      strings is US-ASCII.

   Hence:

         rulename = "abc"

   and:

         rulename = "aBc"

   will match "abc", "Abc", "aBc", "abC", "ABc", "aBC", "AbC", and
   "ABC".
--
Björn Höhrmann · mailto:[e-mail] · http://bjoern.hoehrmann.de Am Badedeich 7 · Telefon: [phone] · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/