Re: [Insipid] Reviews for INSIPID Session-ID solution draft Version 11

["Paul E. Jones" <[e-mail]>]

Paul,

>>>>I think it would be worth to mention that the UUID is case 
>>>>insensitive
>>>>as defined in RFC 4122
>>>
>>>The text currently states that the UUID characters are lower-case. 
>>>The
>>>syntax also enforces this. The RFC 4122 text is funny, because it 
>>>says
>>>"lower case characters and are case insensitive". I don't know what
>>>that means, except that "F" is not a valid character. Rather than
>>>create confusing language, I'd rather just leave the text as it is in
>>>saying the characters are lowercase.
>>
>>[RJ] OK
>
>The *safest* (belt and suspenders) way of dealing with this would be to 
>require that senders always insert lower case, but require that 
>receivers properly process either upper/lower case.
>
>IMO it *should* always have been case-insensitive. IIRC the reason it 
>isn't that way is because Kaplan was case sensitive and there are 
>implementations in the wild that depend on it.

I just looked at RFC 7239 and found this:

    NOTE: The sess-id value is technically case-INSENSITIVE, but only
    lowercase characters are allowed.

Shall we include the same text in our draft?

Paul