Subject: Cookie crumbling in QPACK?

From: Bence Béky <[email-masked]>
Date: Thu, 6 Jun 2019 19:56:16 -0400

Hi,

RFC7540 <https://httpwg.org/specs/rfc7540.html#CompressCookie> allows
crumbling cookies for compression efficiency with HPACK.  However, neither
quic-http <https://quicwg.org/base-drafts/draft-ietf-quic-http.html> nor
quic-qpack <https://quicwg.org/base-drafts/draft-ietf-quic-qpack.html>
drafts mention cookies or crumbling.  Is it considered safe for a QPACK
implementation to crumble cookies before compression and concatenate them
after decompression?  If so, should the draft include clarification on this?

Thanks,

Bence

---

From: Alan Frindell <[email-masked]>
Date: Fri, 7 Jun 2019 16:12:50 +0000

It should be as safe for QPACK as it is for HPACK.  Since HTTP/2 went out of the way to mention it in the draft, I suppose HTTP/3 should also?

-Alan

From: QUIC <[email-masked]> on behalf of Bence Béky <bnc=[email-masked]>
Date: Thursday, June 6, 2019 at 4:57 PM
To: "[email-masked]" <[email-masked]>
Subject: Cookie crumbling in QPACK?

Hi,

RFC7540<https://urldefense.proofpoint.com/v2/url?u=https-3A__httpwg.org_specs_rfc7540.html-23CompressCookie&d=DwMFaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=1ITKsZAeDaw65eyQcdVGcw&m=urPLloJAs-KXlLX8dfjH8UwbzK-aPMcWZC2SWGscpbY&s=l54Q2U8p8mQyKAfrOs5tmZK6-70aqMkAQmJgrxMrJKM&e=> allows crumbling cookies for compression efficiency with HPACK.  However, neither quic-http<https://urldefense.proofpoint.com/v2/url?u=https-3A__quicwg.org_base-2Ddrafts_draft-2Dietf-2Dquic-2Dhttp.html&d=DwMFaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=1ITKsZAeDaw65eyQcdVGcw&m=urPLloJAs-KXlLX8dfjH8UwbzK-aPMcWZC2SWGscpbY&s=_ZUe_ehassD_ZSCA3Z3mkNH6UHQt7PuDXY5i4zDPj7Q&e=> nor quic-qpack<https://urldefense.proofpoint.com/v2/url?u=https-3A__quicwg.org_base-2Ddrafts_draft-2Dietf-2Dquic-2Dqpack.html&d=DwMFaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=1ITKsZAeDaw65eyQcdVGcw&m=urPLloJAs-KXlLX8dfjH8UwbzK-aPMcWZC2SWGscpbY&s=GBguobzHDuTB5rp_Zs4BOZ7ZjKmvS81rA1hL_5teOfA&e=> drafts mention cookies or crumbling.  Is it considered safe for a QPACK implementation to crumble cookies before compression and concatenate them after decompression?  If so, should the draft include clarification on this?

Thanks,

Bence

---

From: Ryan Hamilton <[email-masked]>
Date: Fri, 7 Jun 2019 10:09:43 -0700

On Fri, Jun 7, 2019 at 9:13 AM Alan Frindell <[email-masked]> wrote:

> It should be as safe for QPACK as it is for HPACK.  Since HTTP/2 went out
> of the way to mention it in the draft, I suppose HTTP/3 should also?
>

Agreed. I think HTTP/3 should either mention it explicitly, or normatively
reference 8.1.2.5.

---

From: Roberto Peon <[email-masked]>
Date: Fri, 7 Jun 2019 17:12:34 +0000

Normative reference would make a lot of sense, I think.
-=R

From: QUIC <[email-masked]> on behalf of Ryan Hamilton <rch=[email-masked]>
Date: Friday, June 7, 2019 at 10:11 AM
To: Alan Frindell <[email-masked]>
Cc: Bence Béky <bnc=[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: Cookie crumbling in QPACK?

On Fri, Jun 7, 2019 at 9:13 AM Alan Frindell <[email-masked]<mailto:[email-masked]>> wrote:
It should be as safe for QPACK as it is for HPACK.  Since HTTP/2 went out of the way to mention it in the draft, I suppose HTTP/3 should also?

Agreed. I think HTTP/3 should either mention it explicitly, or normatively reference 8.1.2.5.

---

From: Mike Bishop <[email-masked]>
Date: Fri, 7 Jun 2019 21:10:50 +0000

Filed #2777.

From: QUIC <[email-masked]> On Behalf Of Bence Béky
Sent: Thursday, June 6, 2019 4:56 PM
To: [email-masked]
Subject: Cookie crumbling in QPACK?

Hi,

RFC7540<https://httpwg.org/specs/rfc7540.html#CompressCookie> allows crumbling cookies for compression efficiency with HPACK.  However, neither quic-http<https://quicwg.org/base-drafts/draft-ietf-quic-http.html> nor quic-qpack<https://quicwg.org/base-drafts/draft-ietf-quic-qpack.html> drafts mention cookies or crumbling.  Is it considered safe for a QPACK implementation to crumble cookies before compression and concatenate them after decompression?  If so, should the draft include clarification on this?

Thanks,

Bence