Re: [http-state] Ticket 6: host-only cookies

Dan Winship <dan.winship@gmail.com> Fri, 29 January 2010 14:23 UTC

Return-Path: <dan.winship@gmail.com>
X-Original-To: http-state@core3.amsl.com
Delivered-To: http-state@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2CF543A6A75 for <http-state@core3.amsl.com>; Fri, 29 Jan 2010 06:23:09 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.265
X-Spam-Level:
X-Spam-Status: No, score=-2.265 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X2M1XXdTxi47 for <http-state@core3.amsl.com>; Fri, 29 Jan 2010 06:23:08 -0800 (PST)
Received: from mysterion.org (mysterion.org [69.25.196.35]) by core3.amsl.com (Postfix) with ESMTP id 684C93A697F for <http-state@ietf.org>; Fri, 29 Jan 2010 06:23:08 -0800 (PST)
Received: from desktop.home.mysterion.org (c-76-97-71-164.hsd1.ga.comcast.net [76.97.71.164]) by mysterion.org (Postfix) with ESMTPA id 0B589802AE; Fri, 29 Jan 2010 09:23:29 -0500 (EST)
Message-ID: <4B62EF5D.5070809@gmail.com>
Date: Fri, 29 Jan 2010 09:23:25 -0500
From: Dan Winship <dan.winship@gmail.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.5) Gecko/20091209 Fedora/3.0-4.fc12 Thunderbird/3.0
MIME-Version: 1.0
To: Adam Barth <ietf@adambarth.com>
References: <7789133a1001220050m56cc438x35099b7972639331@mail.gmail.com> <alpine.DEB.2.00.1001220957240.9467@tvnag.unkk.fr> <33259CFA-E50A-46D7-A315-5D68ACB69CDB@apple.com> <2C56E4FA-8BE2-479A-AA53-E64DC3A907E2@gbiv.com> <4B628D14.9080003@corry.biz> <4B629A92.9090101@gmx.de> <4B629D8F.9010503@corry.biz> <7789133a1001290038h51e98ba5q3bdd5ffefe48ff6e@mail.gmail.com>
In-Reply-To: <7789133a1001290038h51e98ba5q3bdd5ffefe48ff6e@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Cc: "Roy T. Fielding" <fielding@gbiv.com>, Daniel Stenberg <daniel@haxx.se>, http-state <http-state@ietf.org>
Subject: Re: [http-state] Ticket 6: host-only cookies
X-BeenThere: http-state@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Discuss HTTP State Management Mechanism <http-state.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/http-state>, <mailto:http-state-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/http-state>
List-Post: <mailto:http-state@ietf.org>
List-Help: <mailto:http-state-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/http-state>, <mailto:http-state-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 29 Jan 2010 14:23:09 -0000

On 01/29/2010 03:38 AM, Adam Barth wrote:
> There's also a minor point about parsing the Date header:
> 
> [[
> Let server-date be the date obtained by parsing the contents of
> the last Date header field as a cookie-date.
> ]]
> 
> http://tools.ietf.org/html/draft-ietf-httpstate-cookie-02#section-5.2.2
> 
> I'm not sure whether that's a big deal though.

2616 and httpbis both say:

      Note: Recipients of date values are encouraged to be robust in
      accepting date values that may have been sent by non-HTTP
      applications

So, you're ok.

Though I'm not convinced the text is needed; the Date header is most
likely generated by a lower-level part of the server stack that was
written by people who are actually aware of the relevant specs. When I
was logging my cookie traffic a few years ago, despite all the
variations I found in cookie Expires attributes, I only found a single
non-rfc1123 Date header, and that was from a guy who had written his own
http server. (And he'd actually already noticed that bug and fixed it,
but not yet deployed the fixed version yet.)