Re: [websec] Strict-Transport-Security syntax redux

[Adam Barth <[e-mail]>]

On Sun, Jan 8, 2012 at 4:10 PM, Bjoern Hoehrmann <[e-mail]> wrote:
> * Tobias Gondrom wrote:
>><hat="chair>
>>as it seems there is disagreement on how to resolve this, with only very
>>few people having spoken out so far, I would like to invite comments
>>from other working group members on this topic to see whether we might
>>have missed something.
>
> It seems to me that all headers defined in RFC 2616 that allow para-
> meteter lists of the `;name=value` form allow the value to be a quoted
> string.

This header isn't defined in RFC 2616 and many headers defined outside
of RFC 2616 don't use quoted-string.

Adam


> If the Working Group wishes to disallow quoted strings, then
> it should use a format that's very different from the existing syntax,
> like `name=value&name=other%20value` or JSON or whatever. "Similar but
> slightly different" always translate into bugs.