RFC 6265bis compliance for the cookie implementation - #869
Conversation
dfc96c0 to
988cc75
Compare
|
@arturobernalg |
@ok2c |
|
@arturobernalg I honestly have no idea how much those new attributes are being used / relied upon in everyday life. I have an impression HTTP cookies are getting used less and less. I was even going to propose to disable automatic cookie handling by default. Anyway, I leave it up to you to make a call here. If you resolve the conflicts I will take another look at the parsing code. |
Enforces the __Secure- and __Host- cookie name prefixes, adds the SameSite attribute with the SameSite=None requires Secure rule, includes the host-only flag in cookie identity, applies the 4096-byte cookie and 1024-byte attribute size limits and the 400-day maximum lifetime, supports nameless cookies in both parsing and serialization, and prevents a non-secure connection from overwriting a stored secure cookie.
988cc75 to
46acea2
Compare
| final String name = tokenParser.parseToken(buffer, cursor, TOKEN_DELIMS); | ||
| if (name.isEmpty()) { | ||
| return null; | ||
| final String token = tokenParser.parseToken(buffer, cursor, TOKEN_DELIMS); |
There was a problem hiding this comment.
@arturobernalg Is this more complex parsing logic something that 6265bis mandates?
I am not going to object to these changes as long as you confirm you know what you are doing.
There was a problem hiding this comment.
@ok2c
Yes. The more permissive parsing is required by the 6265bis user-agent algorithm.
In particular, a Set-Cookie value without = is parsed as a nameless cookie, and the UA parser is intentionally more permissive than the server grammar.
2 participants
Enforces the __
Secure-and__Host-cookie name prefixes, adds theSameSiteattribute with theSameSite=Nonerequires Secure rule, includes the host-only flag in cookie identity, applies the 4096-byte cookie and 1024-byte attribute size limits and the 400-day maximum lifetime, supports nameless cookies in both parsing and serialization, and prevents a non-secure connection from overwriting a stored secure cookie.