Re: [http-state] The Domain attribute (was Re: I-D Action:draft-ietf-httpstate-cookie-20.txt)

[Adam Barth <[e-mail]>]

On Thu, Jan 6, 2011 at 6:13 PM, Paul E. Jones <[e-mail]> wrote:
>> > The empty string is also used in this example:
>> > Set-Cookie: lang=; Expires=Sun, 06 Nov 1994 08:49:37 GMT
>>
>> Why is that?  The "lang" attribute has not been defined, so the valid
>> values for the lang attribute certainly haven't been defined.
>>
>> > For this reason, this might be another area where we need to consider
>> > a syntax change:
>> > cookie-pair       = cookie-name "=" cookie-value cookie-name       =
>> > token cookie-value      = token | ""
>> >                         ^^^^^
>>
>> I would not recommend that servers send empty attribute values.
>> That's just asking for interoperability problems.
>
> But, "lang" is sent in the above example as an empty string.  Thus, this
> should be the definition of "cookie-value":
> cookie-value      = token | ""
>
> As the text is current written, I think this is illegal:
> Set-Cookie: lang=; Expires=Sun, 06 Nov 1994 08:49:37 GMT

Oh, sorry, got confused.  Empty strings should be allowed for
cooke-values but not for attribute-values.

Adam


>> > In any case, I don't have a strong preference and if the group wants
>> > to change the syntax.  That's OK.  It just seems allowing an empty
>> > string for "Domain" is more consistent with the text than not.
>>
>> More consistent with what text?  The text in the User Agent Requirements
>> section is for user agents and not for servers.  You're talking about
>> what's useful for syntax for servers to generate.  It's not useful for
>> servers to generate empty Domain attributes.  Instead of generating an
>> empty Domain attribute, they ought to simply omit the Domain attribute.
>
> OK, that's a good argument. :-)
>
> Paul
>
>