Re: [http-state] Ticket 5: Cookie ordering

[Adam Barth <[e-mail]>]

On Mon, Feb 8, 2010 at 8:49 AM, Paul E. Jones <[e-mail]> wrote:
>> My suggestion would be that the spec should recommend ordering an
>> ordering
>> based on on both domain and path (order of preference to be decided),
>> as
>> that will be more predictable for sites using multiple cookies with the
>> same name at various domain and path levels.
>
> Should we rely on the client to do this?  Your proposal is good, but I'm
> skeptical that I can rely on this as a developer on the server side.

I would recommend against relying on this behavior.  We can explicitly
admonish servers not to rely on this behavior.

> Personally, I'd prefer that the client never send two cookies with the same
> name.  There are two or more cookies in the browser with the same name, I
> would think the browser should only send the cookie with the most precise
> path match.  So, if there is a cookie at / and a cookie at /foo, and the
> user is accessing /foo, only the cookie for that path would be provided.  Is
> there a good reason to send multiple cookies with the same name?

We have to send multiple cookies with the same name because that's
what user agents do today.  We're not permitted to alter the syntax of
the protocol in Phase 1.  In Phase 2, these sorts of changes will be
on the table.

Adam