Re: [http-state] Updated draft

[Daniel Stenberg <[e-mail]>]

On Sun, 16 Aug 2009, Adam Barth wrote:

> I've added tests for both these behaviors to the test suite.  Here's how the 
> five most popular browser behave:

...

> Based on this data, it seems reasonable to spec "sort first on path length 
> and sort second on creation time."  I don't think we'd want to spec any 
> other ordering, and I don't see the benefit of not specing the ordering in 
> the user agent conformance section.

I beg to differ.

First, this sorting was not in the Netscape cookie spec but is only found in 
RFC2109 and RFC2965.

Then, since clearly user agents that don't do any sorting of the cookies can 
play fine against the vast majority of all sites this seems like a client-side 
invention that have no particular meaning to existing servers. So by 
specifying the sort order you not only make a lot of client code 
"non-compliant" all of a sudden, I think you're also over-specifying something 
that doesn't need to be specified.

As far as I can understand, it could only really have a meaning if more than 
50 (or so) cookies are stored for a domain as then the sort order would decide 
which cookies to discard (or rather not include in the Cookie: header). But 
that won't have to imply that the 50 cookies that ARE sent have to be sent in 
this sorted order.

-- 

  / daniel.haxx.se