The rfc6265bis document - the updated #cookie spec - is now in draft-14: ietf.org/archive/id/draft-ietf…
It has been in the works for almost a decade by now!
Cookies: HTTP State Management Mechanism
This document defines the HTTP Cookie and Set-Cookie header fields. These header fields can be used by HTTP servers to store state (called cookies) at HTTP user agents, letting the servers maintain a stateful session over the mostly stateless HTTP pr…www.ietf.org
daniel:// stenberg://
in reply to daniel:// stenberg:// • • •a fun change in this draft compared to the RFC:
"The user agent MUST limit the maximum value of the Max-Age attribute. The limit SHOULD NOT be greater than 400 days (34560000 seconds) in duration. The RECOMMENDED limit is 400 days in duration, but the user agent MAY adjust the limit. Max-Age attributes that are greater than the limit MUST be reduced to the limit."
Stefan Eissing
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to Stefan Eissing • • •"Why 400 days? The goal was to get close to 13 months so that functions one might perform annually (e.g., selecting insurance benefits for the next year) would work even as specific dates varied slightly"
(quote from the original PR with text that was eventually merged)
github.com/httpwg/http-extensi…
Standardize maximum Expires/Max-Age by arichiv · Pull Request #1732 · httpwg/http-extensions
GitHubStefan Eissing
in reply to daniel:// stenberg:// • • •Stefan Eissing
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to Stefan Eissing • • •daniel:// stenberg://
in reply to daniel:// stenberg:// • • •Multiple Cookie: headers vs RFC 9113 · Issue #2541 · httpwg/http-extensions
GitHubKoos van den Hout
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to Koos van den Hout • • •jub0bs
in reply to daniel:// stenberg:// • • •@KHoos I'm not sure what you mean by "cookies are basically always wildcard since they tailmatch"... 🤔
A cookie's Domain attribute determines its scope. In the case of a cookie set without a Domain attribute, browsers only include it in requests to the host that set it.
Am I missing something?
daniel:// stenberg://
in reply to jub0bs • • •daniel:// stenberg://
Unknown parent • • •