Re: [websec] of quoted-string header field param value syntax (was: Strict-Transport-Security syntax redux)

[=JeffH <[e-mail]>]

Thanks for your thoughts,

 > I don't think it matters much what we write in this document.

I overall understand and tend to agree, because I'm doubting we will see much 
if any further extension work for this header field.

 >  However,
 > we can deal with that problem when it comes time to add extension
 > values that actually used quoted-string.

agreed. that's why I'm leaning towards spec'g it with quoted-string at this 
time. It future-proofs the spec at least and we won't have to fight a nit like 
this in Last Calls.

I'm not too worried at this point about user agents not actually implementing 
parsing for as-yet-unspecified-or-even-discussed extension directives for the 
STS header field.

though, I remain curious as to why the STS parsing in Firefox & Chrome is 
apparently each a one-off and doesn't use the more generic HTTP header-field 
parsing routines that are available and which appear to handle quoted-string, 
arbitrary header field parameter ordering, etc.

thanks,

=JeffH