Subject: [http-state] I-D Action:draft-ietf-httpstate-cookie-03.txt

From: [email-masked]
Date: Sat, 13 Feb 2010 00:00:01 -0800 (PST)

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the HTTP State Management Mechanism Working Group of the IETF.

	Title           : HTTP State Management Mechanism
	Author(s)       : A. Barth
	Filename        : draft-ietf-httpstate-cookie-03.txt
	Pages           : 29
	Date            : 2010-02-12

This document defines the HTTP Cookie and Set-Cookie headers.  These
headers can be used by HTTP servers to store state on HTTP user
agents, letting the servers maintain a stateful session over the
mostly stateless HTTP protocol.  The cookie protocol has many
historical infelicities and should be avoided for new applications of
HTTP.

NOTE: If you have suggestions for improving the draft, please send

email to [email-masked].  Suggestions with test cases are

especially appreciated.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-httpstate-cookie-03.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Achim Hoffmann <[email-masked]>
Date: Mon, 22 Feb 2010 19:11:58 +0100

Simple question about the *dates" in this draft:

1) If I understand 5.1.1. Dates correctly, the format of the date is
   fixed and must be in GMT.
   IIRC the date format in RFC2616 allows more variants. Also the timezone
   may be different to GMT (see RFC2616, 19.3).

   So the definitions in this draft would brake old behaviours.
   (Though, from a security point of view, I'd prefer the draft definition:)

2) In 4.1.2. Semantics (third paragraph) we read:
	" .. by including an Expires attribute with a value in the past."
   This is a bit missleading unless all date formats are GMT (see 1) above).

Achim

> ------------------------------------------------------------------------
> 
> _______________________________________________
> http-state mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-state

---

From: Julian Reschke <[email-masked]>
Date: Mon, 22 Feb 2010 19:27:11 +0100

>     may be different to GMT (see RFC2616, 19.3).

a) It requires recipients to accept certain obsolete formats, but also 
requires senders to use only rfc1123-date format.

b) What you see in 19.3 aren't requirements, but recommendations for 
handling invalid dates. The requirements are in Section 3.3 which says:

"All HTTP date/time stamps MUST be represented in Greenwich Mean Time 
(GMT), without exception."

> ...

BR, Julian

---

From: Achim Hoffmann <[email-masked]>
Date: Tue, 23 Feb 2010 00:06:21 +0100 (MET)

Is there a typo in 5.2.6.  The HttpOnly Attribute ?

  ".. with an attribute-name of Secure and an empt attribute-value."

I guess "Secure" should be "HttpOnly".

Achim

!! A New Internet-Draft is available from the on-line Internet-Drafts directories.
!! This draft is a work item of the HTTP State Management Mechanism Working Group of the IETF.
!! 
!! 
!! 	Title           : HTTP State Management Mechanism
!! 	Author(s)       : A. Barth
!! 	Filename        : draft-ietf-httpstate-cookie-03.txt
!! 	Pages           : 29
!! 	Date            : 2010-02-12
!! 
!! This document defines the HTTP Cookie and Set-Cookie headers.  These
!! headers can be used by HTTP servers to store state on HTTP user
!! agents, letting the servers maintain a stateful session over the
!! mostly stateless HTTP protocol.  The cookie protocol has many
!! historical infelicities and should be avoided for new applications of
!! HTTP.
!! 
!! 
!! NOTE: If you have suggestions for improving the draft, please send
!! 
!! email to [email-masked].  Suggestions with test cases are
!! 
!! especially appreciated.
!! 
!! A URL for this Internet-Draft is:
!! http://www.ietf.org/internet-drafts/draft-ietf-httpstate-cookie-03.txt
!! 
!! Internet-Drafts are also available by anonymous FTP at:
!! ftp://ftp.ietf.org/internet-drafts/
!! 
!! Below is the data which will enable a MIME compliant mail reader
!! implementation to automatically retrieve the ASCII version of the
!! Internet-Draft.

---

From: Adam Barth <[email-masked]>
Date: Mon, 22 Feb 2010 22:32:29 -0800

>   (Though, from a security point of view, I'd prefer the draft definition:)

The date format in 5.1.1. is specifically constructed to avoid
breaking legacy servers.  Is your concern based on a specific legacy
server or general philosophy?

>   This is a bit missleading unless all date formats are GMT (see 1) above).

This section is non-normative.  If the server behaves as recommended
(e.g., uses rfc1123-date), then this advice is sensible.

Adam

---

From: Adam Barth <[email-masked]>
Date: Mon, 22 Feb 2010 22:33:38 -0800

> I guess "Secure" should be "HttpOnly".

Fix.  Thanks!

Adam

---

From: David Morris <[email-masked]>
Date: Mon, 22 Feb 2010 23:08:48 -0800 (PST)

Going from memory, I thought secure meant only sent of HTTPS and HttpOnly
was introduced since the original NS cookie spec to prevent script
access to the cookie.

---

From: Achim Hoffmann <[email-masked]>
Date: Tue, 23 Feb 2010 08:46:29 +0100

Hi Adam,

Julian already gave the answer:
  dates from the server MUST be in rfc1123 format
  the browser MAY accept other formats

So I don't have concerns.
Thanks for clarifying.

Achim

---

From: Achim Hoffmann <[email-masked]>
Date: Tue, 23 Feb 2010 08:54:43 +0100

The section
  5.4.  The Cookie Header
      2.  Sort the cookie-list in the following order:

seems to be incmplete (missing the [TODO: ...] comment :)

Should I comment on that in detail in the other thread?
  Subject: [http-state] Summary of discussion of Ticket 5 (Cookie ordering)

Achim

> ftp://ftp.ietf.org/internet-drafts/

Subject: [http-state] Summary of discussion of Ticket 5 (Cookie ordering)

---

From: Adam Barth <[email-masked]>
Date: Tue, 23 Feb 2010 08:06:42 -0800

That's correct.  I believe that's what the draft says currently.

Adam

---

From: Adam Barth <[email-masked]>
Date: Tue, 23 Feb 2010 08:09:21 -0800

I'm not sure I understand your message.  We haven't agreed what the
text of that section should say yet.  We're tracking the issue with
http://trac.tools.ietf.org/wg/httpstate/trac/ticket/5.  The TODOs are
for things I can do myself (e.g., adding examples).

Adam