Update Cookie class and other specifications for RFC 6265

[glassfishrobot]

Update Cookie class and other specifications for RFC 6265

[glassfishrobot]

• Issue Imported From: https://github.com/javaee/servlet-spec/issues/37
• Original Issue Raised By:@glassfishrobot
• Original Issue Assigned To: @shingwaichan

[glassfishrobot]

@glassfishrobot Commented
Reported by gregwilkins

[glassfishrobot]

@glassfishrobot Commented
gregwilkins said:
Actually my example of a , in the cookie value is wrong, as although google appears do be doing that, it is not allowed by RFC6265.
However, I do believe it is worthwhile reviewing the Cookie class and other cookie related parts of the spec against the latest RFC.

[glassfishrobot]

@glassfishrobot Commented
markt_asf said:
My experience has been that no matter what cookie specification is followed by the container, there will be a client or application that can't handle specification compliant values. We have had to add no end of hacks to Tomcat's cookie handling to allow checks to be bypassed to enable stuff to actually work. For example, anything that requires quoting (such as using commas in values) is often not handled correctly if it is quoted.

There is a clear unwillingness on the part of some browser vendors to adhere to the cookie specifications and no sign of this being a something that causes users to migrate to a more standards compliant browser.

I don't particularly like the situation that has lead to RFC 6265 (I would have preferred to see user demand driving browser compliance but that hasn't happened) but RFC 6265 is probably the best option since it is closer to what is actually happening than anything else. That said, I suspect container vendors will still need to add additional options to bypass some checks.

[glassfishrobot]

@glassfishrobot Commented
@shingwaichan said:
Adding it to the bucket of FUTURE_RELEASE

[glassfishrobot]

@glassfishrobot Commented
markt_asf said:
Ping. This really needs to get into Servlet 4.0

[glassfishrobot]

@glassfishrobot Commented
christopherschultz said:
+1 for updating and clarifying the spec. If Servlet 4.0 still contains a requirement to support RFC2019 (and nothing more recent), then the Java ecosystem will continue to suffer this confusion for another few years.

[glassfishrobot]

@glassfishrobot Commented
This issue was imported from java.net JIRA SERVLET_SPEC-37