| 1 | <!DOCTYPE html |
|---|
| 2 | PUBLIC "-//W3C//DTD HTML 4.01//EN"> |
|---|
| 3 | <html lang="en"> |
|---|
| 4 | <head profile="http://www.w3.org/2006/03/hcard"> |
|---|
| 5 | <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> |
|---|
| 6 | <title>HTTP State Management Mechanism</title><style type="text/css" title="Xml2Rfc (sans serif)"> |
|---|
| 7 | a { |
|---|
| 8 | text-decoration: none; |
|---|
| 9 | } |
|---|
| 10 | a.smpl { |
|---|
| 11 | color: black; |
|---|
| 12 | } |
|---|
| 13 | a:hover { |
|---|
| 14 | text-decoration: underline; |
|---|
| 15 | } |
|---|
| 16 | a:active { |
|---|
| 17 | text-decoration: underline; |
|---|
| 18 | } |
|---|
| 19 | address { |
|---|
| 20 | margin-top: 1em; |
|---|
| 21 | margin-left: 2em; |
|---|
| 22 | font-style: normal; |
|---|
| 23 | } |
|---|
| 24 | body { |
|---|
| 25 | color: black; |
|---|
| 26 | font-family: verdana, helvetica, arial, sans-serif; |
|---|
| 27 | font-size: 10pt; |
|---|
| 28 | } |
|---|
| 29 | cite { |
|---|
| 30 | font-style: normal; |
|---|
| 31 | } |
|---|
| 32 | dd { |
|---|
| 33 | margin-right: 2em; |
|---|
| 34 | } |
|---|
| 35 | dl { |
|---|
| 36 | margin-left: 2em; |
|---|
| 37 | } |
|---|
| 38 | |
|---|
| 39 | dl.empty dd { |
|---|
| 40 | margin-top: .5em; |
|---|
| 41 | } |
|---|
| 42 | dl p { |
|---|
| 43 | margin-left: 0em; |
|---|
| 44 | } |
|---|
| 45 | dt { |
|---|
| 46 | margin-top: .5em; |
|---|
| 47 | } |
|---|
| 48 | h1 { |
|---|
| 49 | font-size: 14pt; |
|---|
| 50 | line-height: 21pt; |
|---|
| 51 | page-break-after: avoid; |
|---|
| 52 | } |
|---|
| 53 | h1.np { |
|---|
| 54 | page-break-before: always; |
|---|
| 55 | } |
|---|
| 56 | h1 a { |
|---|
| 57 | color: #333333; |
|---|
| 58 | } |
|---|
| 59 | h2 { |
|---|
| 60 | font-size: 12pt; |
|---|
| 61 | line-height: 15pt; |
|---|
| 62 | page-break-after: avoid; |
|---|
| 63 | } |
|---|
| 64 | h2 a { |
|---|
| 65 | color: black; |
|---|
| 66 | } |
|---|
| 67 | h3 { |
|---|
| 68 | font-size: 10pt; |
|---|
| 69 | page-break-after: avoid; |
|---|
| 70 | } |
|---|
| 71 | h3 a { |
|---|
| 72 | color: black; |
|---|
| 73 | } |
|---|
| 74 | h4 { |
|---|
| 75 | font-size: 10pt; |
|---|
| 76 | page-break-after: avoid; |
|---|
| 77 | } |
|---|
| 78 | h4 a { |
|---|
| 79 | color: black; |
|---|
| 80 | } |
|---|
| 81 | h5 { |
|---|
| 82 | font-size: 10pt; |
|---|
| 83 | page-break-after: avoid; |
|---|
| 84 | } |
|---|
| 85 | h5 a { |
|---|
| 86 | color: black; |
|---|
| 87 | } |
|---|
| 88 | img { |
|---|
| 89 | margin-left: 3em; |
|---|
| 90 | } |
|---|
| 91 | li { |
|---|
| 92 | margin-left: 2em; |
|---|
| 93 | margin-right: 2em; |
|---|
| 94 | } |
|---|
| 95 | ol { |
|---|
| 96 | margin-left: 2em; |
|---|
| 97 | margin-right: 2em; |
|---|
| 98 | } |
|---|
| 99 | ol p { |
|---|
| 100 | margin-left: 0em; |
|---|
| 101 | } |
|---|
| 102 | p { |
|---|
| 103 | margin-left: 2em; |
|---|
| 104 | margin-right: 2em; |
|---|
| 105 | } |
|---|
| 106 | pre { |
|---|
| 107 | margin-left: 3em; |
|---|
| 108 | background-color: lightyellow; |
|---|
| 109 | padding: .25em; |
|---|
| 110 | } |
|---|
| 111 | pre.text2 { |
|---|
| 112 | border-style: dotted; |
|---|
| 113 | border-width: 1px; |
|---|
| 114 | background-color: #f0f0f0; |
|---|
| 115 | width: 69em; |
|---|
| 116 | } |
|---|
| 117 | pre.inline { |
|---|
| 118 | background-color: white; |
|---|
| 119 | padding: 0em; |
|---|
| 120 | } |
|---|
| 121 | pre.text { |
|---|
| 122 | border-style: dotted; |
|---|
| 123 | border-width: 1px; |
|---|
| 124 | background-color: #f8f8f8; |
|---|
| 125 | width: 69em; |
|---|
| 126 | } |
|---|
| 127 | pre.drawing { |
|---|
| 128 | border-style: solid; |
|---|
| 129 | border-width: 1px; |
|---|
| 130 | background-color: #f8f8f8; |
|---|
| 131 | padding: 2em; |
|---|
| 132 | } |
|---|
| 133 | table { |
|---|
| 134 | margin-left: 2em; |
|---|
| 135 | } |
|---|
| 136 | table.header { |
|---|
| 137 | width: 95%; |
|---|
| 138 | font-size: 10pt; |
|---|
| 139 | color: white; |
|---|
| 140 | } |
|---|
| 141 | td.top { |
|---|
| 142 | vertical-align: top; |
|---|
| 143 | } |
|---|
| 144 | td.topnowrap { |
|---|
| 145 | vertical-align: top; |
|---|
| 146 | white-space: nowrap; |
|---|
| 147 | } |
|---|
| 148 | td.header { |
|---|
| 149 | background-color: gray; |
|---|
| 150 | width: 50%; |
|---|
| 151 | } |
|---|
| 152 | td.reference { |
|---|
| 153 | vertical-align: top; |
|---|
| 154 | white-space: nowrap; |
|---|
| 155 | padding-right: 1em; |
|---|
| 156 | } |
|---|
| 157 | thead { |
|---|
| 158 | display:table-header-group; |
|---|
| 159 | } |
|---|
| 160 | ul.toc { |
|---|
| 161 | list-style: none; |
|---|
| 162 | margin-left: 1.5em; |
|---|
| 163 | margin-right: 0em; |
|---|
| 164 | padding-left: 0em; |
|---|
| 165 | } |
|---|
| 166 | li.tocline0 { |
|---|
| 167 | line-height: 150%; |
|---|
| 168 | font-weight: bold; |
|---|
| 169 | font-size: 10pt; |
|---|
| 170 | margin-left: 0em; |
|---|
| 171 | margin-right: 0em; |
|---|
| 172 | } |
|---|
| 173 | li.tocline1 { |
|---|
| 174 | line-height: normal; |
|---|
| 175 | font-weight: normal; |
|---|
| 176 | font-size: 9pt; |
|---|
| 177 | margin-left: 0em; |
|---|
| 178 | margin-right: 0em; |
|---|
| 179 | } |
|---|
| 180 | li.tocline2 { |
|---|
| 181 | font-size: 0pt; |
|---|
| 182 | } |
|---|
| 183 | ul p { |
|---|
| 184 | margin-left: 0em; |
|---|
| 185 | } |
|---|
| 186 | ul.ind { |
|---|
| 187 | list-style: none; |
|---|
| 188 | margin-left: 1.5em; |
|---|
| 189 | margin-right: 0em; |
|---|
| 190 | padding-left: 0em; |
|---|
| 191 | } |
|---|
| 192 | li.indline0 { |
|---|
| 193 | font-weight: bold; |
|---|
| 194 | line-height: 200%; |
|---|
| 195 | margin-left: 0em; |
|---|
| 196 | margin-right: 0em; |
|---|
| 197 | } |
|---|
| 198 | li.indline1 { |
|---|
| 199 | font-weight: normal; |
|---|
| 200 | line-height: 150%; |
|---|
| 201 | margin-left: 0em; |
|---|
| 202 | margin-right: 0em; |
|---|
| 203 | } |
|---|
| 204 | .bcp14 { |
|---|
| 205 | font-style: normal; |
|---|
| 206 | text-transform: lowercase; |
|---|
| 207 | font-variant: small-caps; |
|---|
| 208 | } |
|---|
| 209 | .comment { |
|---|
| 210 | background-color: yellow; |
|---|
| 211 | } |
|---|
| 212 | .center { |
|---|
| 213 | text-align: center; |
|---|
| 214 | } |
|---|
| 215 | .error { |
|---|
| 216 | color: red; |
|---|
| 217 | font-style: italic; |
|---|
| 218 | font-weight: bold; |
|---|
| 219 | } |
|---|
| 220 | .figure { |
|---|
| 221 | font-weight: bold; |
|---|
| 222 | text-align: center; |
|---|
| 223 | font-size: 9pt; |
|---|
| 224 | } |
|---|
| 225 | .filename { |
|---|
| 226 | color: #333333; |
|---|
| 227 | font-weight: bold; |
|---|
| 228 | font-size: 12pt; |
|---|
| 229 | line-height: 21pt; |
|---|
| 230 | text-align: center; |
|---|
| 231 | } |
|---|
| 232 | .fn { |
|---|
| 233 | font-weight: bold; |
|---|
| 234 | } |
|---|
| 235 | .hidden { |
|---|
| 236 | display: none; |
|---|
| 237 | } |
|---|
| 238 | .left { |
|---|
| 239 | text-align: left; |
|---|
| 240 | } |
|---|
| 241 | .right { |
|---|
| 242 | text-align: right; |
|---|
| 243 | } |
|---|
| 244 | .title { |
|---|
| 245 | color: #990000; |
|---|
| 246 | font-size: 18pt; |
|---|
| 247 | line-height: 18pt; |
|---|
| 248 | font-weight: bold; |
|---|
| 249 | text-align: center; |
|---|
| 250 | margin-top: 36pt; |
|---|
| 251 | } |
|---|
| 252 | .vcardline { |
|---|
| 253 | display: block; |
|---|
| 254 | } |
|---|
| 255 | .warning { |
|---|
| 256 | font-size: 14pt; |
|---|
| 257 | background-color: yellow; |
|---|
| 258 | } |
|---|
| 259 | |
|---|
| 260 | |
|---|
| 261 | @media print { |
|---|
| 262 | .noprint { |
|---|
| 263 | display: none; |
|---|
| 264 | } |
|---|
| 265 | |
|---|
| 266 | a { |
|---|
| 267 | color: black; |
|---|
| 268 | text-decoration: none; |
|---|
| 269 | } |
|---|
| 270 | |
|---|
| 271 | table.header { |
|---|
| 272 | width: 90%; |
|---|
| 273 | } |
|---|
| 274 | |
|---|
| 275 | td.header { |
|---|
| 276 | width: 50%; |
|---|
| 277 | color: black; |
|---|
| 278 | background-color: white; |
|---|
| 279 | vertical-align: top; |
|---|
| 280 | font-size: 12pt; |
|---|
| 281 | } |
|---|
| 282 | |
|---|
| 283 | ul.toc a::after { |
|---|
| 284 | content: leader('.') target-counter(attr(href), page); |
|---|
| 285 | } |
|---|
| 286 | |
|---|
| 287 | a.iref { |
|---|
| 288 | content: target-counter(attr(href), page); |
|---|
| 289 | } |
|---|
| 290 | |
|---|
| 291 | .print2col { |
|---|
| 292 | column-count: 2; |
|---|
| 293 | -moz-column-count: 2; |
|---|
| 294 | column-fill: auto; |
|---|
| 295 | } |
|---|
| 296 | } |
|---|
| 297 | |
|---|
| 298 | @page { |
|---|
| 299 | @top-left { |
|---|
| 300 | content: "INTERNET DRAFT"; |
|---|
| 301 | } |
|---|
| 302 | @top-right { |
|---|
| 303 | content: "October 2000"; |
|---|
| 304 | } |
|---|
| 305 | @top-center { |
|---|
| 306 | content: "HTTP State Management Mechanism"; |
|---|
| 307 | } |
|---|
| 308 | @bottom-left { |
|---|
| 309 | content: "Kristol & Montulli"; |
|---|
| 310 | } |
|---|
| 311 | @bottom-center { |
|---|
| 312 | content: "Standards Track"; |
|---|
| 313 | } |
|---|
| 314 | @bottom-right { |
|---|
| 315 | content: "[Page " counter(page) "]"; |
|---|
| 316 | } |
|---|
| 317 | } |
|---|
| 318 | |
|---|
| 319 | @page:first { |
|---|
| 320 | @top-left { |
|---|
| 321 | content: normal; |
|---|
| 322 | } |
|---|
| 323 | @top-right { |
|---|
| 324 | content: normal; |
|---|
| 325 | } |
|---|
| 326 | @top-center { |
|---|
| 327 | content: normal; |
|---|
| 328 | } |
|---|
| 329 | } |
|---|
| 330 | </style><link rel="Contents" href="#rfc.toc"> |
|---|
| 331 | <link rel="Author" href="#rfc.authors"> |
|---|
| 332 | <link rel="Copyright" href="#rfc.copyright"> |
|---|
| 333 | <link rel="Index" href="#rfc.index"> |
|---|
| 334 | <link rel="Chapter" title="1 TERMINOLOGY" href="#rfc.section.1"> |
|---|
| 335 | <link rel="Chapter" title="2 STATE AND SESSIONS" href="#rfc.section.2"> |
|---|
| 336 | <link rel="Chapter" title="3 DESCRIPTION" href="#rfc.section.3"> |
|---|
| 337 | <link rel="Chapter" title="4 EXAMPLES" href="#rfc.section.4"> |
|---|
| 338 | <link rel="Chapter" title="5 IMPLEMENTATION CONSIDERATIONS" href="#rfc.section.5"> |
|---|
| 339 | <link rel="Chapter" title="6 PRIVACY" href="#rfc.section.6"> |
|---|
| 340 | <link rel="Chapter" title="7 IANA Considerations" href="#rfc.section.7"> |
|---|
| 341 | <link rel="Chapter" title="8 SECURITY CONSIDERATIONS" href="#rfc.section.8"> |
|---|
| 342 | <link rel="Chapter" title="9 OTHER, SIMILAR, PROPOSALS" href="#rfc.section.9"> |
|---|
| 343 | <link rel="Chapter" title="10 HISTORICAL" href="#rfc.section.10"> |
|---|
| 344 | <link rel="Chapter" title="11 ACKNOWLEDGEMENTS" href="#rfc.section.11"> |
|---|
| 345 | <link rel="Chapter" href="#rfc.section.12" title="12 References"> |
|---|
| 346 | <meta name="generator" content="http://greenbytes.de/tech/webdav/rfc2629.xslt, Revision 1.353, 2007/12/11 23:20:44, XSLT vendor: SAXON 8.9 from Saxonica http://www.saxonica.com/"> |
|---|
| 347 | <link rel="schema.DC" href="http://purl.org/dc/elements/1.1/"> |
|---|
| 348 | <meta name="DC.Creator" content="Kristol, D. M."> |
|---|
| 349 | <meta name="DC.Creator" content="Montulli, L."> |
|---|
| 350 | <meta name="DC.Identifier" content="urn:ietf:id:draft-ietf-httpbis-p8-cookies-00"> |
|---|
| 351 | <meta name="DC.Date.Issued" scheme="ISO8601" content="2000-10"> |
|---|
| 352 | <meta name="DC.Relation.Replaces" content="urn:ietf:rfc:2109"> |
|---|
| 353 | <meta name="DC.Relation.Replaces" content="urn:ietf:rfc:2965"> |
|---|
| 354 | <meta name="DC.Description.Abstract" content="This document specifies a way to create a stateful session with Hypertext Transfer Protocol (HTTP) requests and responses. It describes three new headers, Cookie, Cookie2, and Set-Cookie2, which carry state information between participating origin servers and user agents. The method described here differs from Netscape's Cookie proposal , but it can interoperate with HTTP/1.0 user agents that use Netscape's method. (See the HISTORICAL section.) This document reflects implementation experience with RFC 2109 and obsoletes it."> |
|---|
| 355 | </head> |
|---|
| 356 | <body> |
|---|
| 357 | <table summary="header information" class="header" border="0" cellpadding="1" cellspacing="1"> |
|---|
| 358 | <tr> |
|---|
| 359 | <td class="header left">Network Working Group</td> |
|---|
| 360 | <td class="header right">D. M. Kristol</td> |
|---|
| 361 | </tr> |
|---|
| 362 | <tr> |
|---|
| 363 | <td class="header left">Internet Draft</td> |
|---|
| 364 | <td class="header right">Bell Laboratories, Lucent Technologies</td> |
|---|
| 365 | </tr> |
|---|
| 366 | <tr> |
|---|
| 367 | <td class="header left"> |
|---|
| 368 | <draft-ietf-httpbis-p8-cookies-00> |
|---|
| 369 | |
|---|
| 370 | </td> |
|---|
| 371 | <td class="header right">L. Montulli</td> |
|---|
| 372 | </tr> |
|---|
| 373 | <tr> |
|---|
| 374 | <td class="header left">Obsoletes: <a href="http://tools.ietf.org/html/rfc2109">2109</a>, |
|---|
| 375 | <a href="http://tools.ietf.org/html/rfc2965">2965</a> (if approved) |
|---|
| 376 | </td> |
|---|
| 377 | <td class="header right">Epinions.com, Inc.</td> |
|---|
| 378 | </tr> |
|---|
| 379 | <tr> |
|---|
| 380 | <td class="header left">Intended status: Standards Track</td> |
|---|
| 381 | <td class="header right">October 2000</td> |
|---|
| 382 | </tr> |
|---|
| 383 | <tr> |
|---|
| 384 | <td class="header left">Expires: April 2001</td> |
|---|
| 385 | <td class="header right"></td> |
|---|
| 386 | </tr> |
|---|
| 387 | </table> |
|---|
| 388 | <p class="title">HTTP State Management Mechanism<br><span class="filename">draft-ietf-httpbis-p8-cookies-00</span></p> |
|---|
| 389 | <h1><a id="rfc.status" href="#rfc.status">Status of this Memo</a></h1> |
|---|
| 390 | <p>By submitting this Internet-Draft, each author represents that any applicable patent or other IPR claims of which he or she |
|---|
| 391 | is aware have been or will be disclosed, and any of which he or she becomes aware will be disclosed, in accordance with Section |
|---|
| 392 | 6 of BCP 79. |
|---|
| 393 | </p> |
|---|
| 394 | <p>Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note |
|---|
| 395 | that other groups may also distribute working documents as Internet-Drafts. |
|---|
| 396 | </p> |
|---|
| 397 | <p>Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other |
|---|
| 398 | documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as “work |
|---|
| 399 | in progress”. |
|---|
| 400 | </p> |
|---|
| 401 | <p>The list of current Internet-Drafts can be accessed at <<a href="http://www.ietf.org/ietf/1id-abstracts.txt">http://www.ietf.org/ietf/1id-abstracts.txt</a>>. |
|---|
| 402 | </p> |
|---|
| 403 | <p>The list of Internet-Draft Shadow Directories can be accessed at <<a href="http://www.ietf.org/shadow.html">http://www.ietf.org/shadow.html</a>>. |
|---|
| 404 | </p> |
|---|
| 405 | <p>This Internet-Draft will expire in April 2001.</p> |
|---|
| 406 | <h1><a id="rfc.copyrightnotice" href="#rfc.copyrightnotice">Copyright Notice</a></h1> |
|---|
| 407 | <p>Copyright © The Internet Society (2000). All Rights Reserved.</p> |
|---|
| 408 | <h1 id="rfc.abstract"><a href="#rfc.abstract">Abstract</a></h1> |
|---|
| 409 | <p>This document specifies a way to create a stateful session with Hypertext Transfer Protocol (HTTP) requests and responses. |
|---|
| 410 | It describes three new headers, Cookie, Cookie2, and Set-Cookie2, which carry state information between participating origin |
|---|
| 411 | servers and user agents. The method described here differs from Netscape's Cookie proposal <a href="#Netscape" id="rfc.xref.Netscape.1"><cite title="Persistent Client State -- HTTP Cookies">[Netscape]</cite></a>, but it can interoperate with HTTP/1.0 user agents that use Netscape's method. (See the HISTORICAL section.) |
|---|
| 412 | </p> |
|---|
| 413 | <p>This document reflects implementation experience with RFC 2109 and obsoletes it.</p> |
|---|
| 414 | <hr class="noprint"> |
|---|
| 415 | <h1 class="np" id="rfc.toc"><a href="#rfc.toc">Table of Contents</a></h1> |
|---|
| 416 | <ul class="toc"> |
|---|
| 417 | <li class="tocline0">1. <a href="#rfc.section.1">TERMINOLOGY</a><ul class="toc"> |
|---|
| 418 | <li class="tocline1">1.1 <a href="#rfc.section.1.1">Requirements</a></li> |
|---|
| 419 | </ul> |
|---|
| 420 | </li> |
|---|
| 421 | <li class="tocline0">2. <a href="#rfc.section.2">STATE AND SESSIONS</a></li> |
|---|
| 422 | <li class="tocline0">3. <a href="#rfc.section.3">DESCRIPTION</a><ul class="toc"> |
|---|
| 423 | <li class="tocline1">3.1 <a href="#rfc.section.3.1">Syntax: General</a></li> |
|---|
| 424 | <li class="tocline1">3.2 <a href="#rfc.section.3.2">Origin Server Role</a><ul class="toc"> |
|---|
| 425 | <li class="tocline1">3.2.1 <a href="#rfc.section.3.2.1">General</a></li> |
|---|
| 426 | <li class="tocline1">3.2.2 <a href="#rfc.section.3.2.2">Set-Cookie2 Syntax</a></li> |
|---|
| 427 | <li class="tocline1">3.2.3 <a href="#rfc.section.3.2.3">Controlling Caching</a></li> |
|---|
| 428 | </ul> |
|---|
| 429 | </li> |
|---|
| 430 | <li class="tocline1">3.3 <a href="#rfc.section.3.3">User Agent Role</a><ul class="toc"> |
|---|
| 431 | <li class="tocline1">3.3.1 <a href="#rfc.section.3.3.1">Interpreting Set-Cookie2</a></li> |
|---|
| 432 | <li class="tocline1">3.3.2 <a href="#rfc.section.3.3.2">Rejecting Cookies</a></li> |
|---|
| 433 | <li class="tocline1">3.3.3 <a href="#rfc.section.3.3.3">Cookie Management</a></li> |
|---|
| 434 | <li class="tocline1">3.3.4 <a href="#rfc.section.3.3.4">Sending Cookies to the Origin Server</a></li> |
|---|
| 435 | <li class="tocline1">3.3.5 <a href="#rfc.section.3.3.5">Identifying What Version is Understood: Cookie2</a></li> |
|---|
| 436 | <li class="tocline1">3.3.6 <a href="#rfc.section.3.3.6">Sending Cookies in Unverifiable Transactions</a></li> |
|---|
| 437 | </ul> |
|---|
| 438 | </li> |
|---|
| 439 | <li class="tocline1">3.4 <a href="#rfc.section.3.4">How an Origin Server Interprets the Cookie Header</a></li> |
|---|
| 440 | <li class="tocline1">3.5 <a href="#rfc.section.3.5">Caching Proxy Role</a></li> |
|---|
| 441 | </ul> |
|---|
| 442 | </li> |
|---|
| 443 | <li class="tocline0">4. <a href="#rfc.section.4">EXAMPLES</a><ul class="toc"> |
|---|
| 444 | <li class="tocline1">4.1 <a href="#rfc.section.4.1">Example 1</a></li> |
|---|
| 445 | <li class="tocline1">4.2 <a href="#rfc.section.4.2">Example 2</a></li> |
|---|
| 446 | </ul> |
|---|
| 447 | </li> |
|---|
| 448 | <li class="tocline0">5. <a href="#rfc.section.5">IMPLEMENTATION CONSIDERATIONS</a><ul class="toc"> |
|---|
| 449 | <li class="tocline1">5.1 <a href="#rfc.section.5.1">Set-Cookie2 Content</a></li> |
|---|
| 450 | <li class="tocline1">5.2 <a href="#rfc.section.5.2">Stateless Pages</a></li> |
|---|
| 451 | <li class="tocline1">5.3 <a href="#rfc.section.5.3">Implementation Limits</a><ul class="toc"> |
|---|
| 452 | <li class="tocline1">5.3.1 <a href="#rfc.section.5.3.1">Denial of Service Attacks</a></li> |
|---|
| 453 | </ul> |
|---|
| 454 | </li> |
|---|
| 455 | </ul> |
|---|
| 456 | </li> |
|---|
| 457 | <li class="tocline0">6. <a href="#rfc.section.6">PRIVACY</a><ul class="toc"> |
|---|
| 458 | <li class="tocline1">6.1 <a href="#rfc.section.6.1">User Agent Control</a></li> |
|---|
| 459 | <li class="tocline1">6.2 <a href="#rfc.section.6.2">Origin Server Role</a></li> |
|---|
| 460 | <li class="tocline1">6.3 <a href="#rfc.section.6.3">Clear Text</a></li> |
|---|
| 461 | </ul> |
|---|
| 462 | </li> |
|---|
| 463 | <li class="tocline0">7. <a href="#IANA.considerations">IANA Considerations</a></li> |
|---|
| 464 | <li class="tocline0">8. <a href="#rfc.section.8">SECURITY CONSIDERATIONS</a><ul class="toc"> |
|---|
| 465 | <li class="tocline1">8.1 <a href="#rfc.section.8.1">Protocol Design</a></li> |
|---|
| 466 | <li class="tocline1">8.2 <a href="#rfc.section.8.2">Cookie Spoofing</a></li> |
|---|
| 467 | <li class="tocline1">8.3 <a href="#rfc.section.8.3">Unexpected Cookie Sharing</a></li> |
|---|
| 468 | <li class="tocline1">8.4 <a href="#rfc.section.8.4">Cookies For Account Information</a></li> |
|---|
| 469 | </ul> |
|---|
| 470 | </li> |
|---|
| 471 | <li class="tocline0">9. <a href="#rfc.section.9">OTHER, SIMILAR, PROPOSALS</a></li> |
|---|
| 472 | <li class="tocline0">10. <a href="#rfc.section.10">HISTORICAL</a><ul class="toc"> |
|---|
| 473 | <li class="tocline1">10.1 <a href="#rfc.section.10.1">Compatibility with Existing Implementations</a></li> |
|---|
| 474 | <li class="tocline1">10.2 <a href="#rfc.section.10.2">Caching and HTTP/1.0</a></li> |
|---|
| 475 | </ul> |
|---|
| 476 | </li> |
|---|
| 477 | <li class="tocline0">11. <a href="#rfc.section.11">ACKNOWLEDGEMENTS</a></li> |
|---|
| 478 | <li class="tocline0">12. <a href="#rfc.references">References</a></li> |
|---|
| 479 | <li class="tocline0"><a href="#rfc.authors">Authors' Addresses</a></li> |
|---|
| 480 | <li class="tocline0"><a href="#rfc.ipr">Intellectual Property and Copyright Statements</a></li> |
|---|
| 481 | <li class="tocline0"><a href="#rfc.index">Index</a></li> |
|---|
| 482 | </ul> |
|---|
| 483 | <h1 id="rfc.section.1" class="np"><a href="#rfc.section.1">1.</a> TERMINOLOGY |
|---|
| 484 | </h1> |
|---|
| 485 | <p id="rfc.section.1.p.1">The terms user agent, client, server, proxy, origin server, and http_URL have the same meaning as in the HTTP/1.1 specification <a href="#RFC2616" id="rfc.xref.RFC2616.1"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>. The terms abs_path and absoluteURI have the same meaning as in the URI Syntax specification <a href="#RFC2396" id="rfc.xref.RFC2396.1"><cite title="Uniform Resource Identifiers (URI): Generic Syntax">[RFC2396]</cite></a>. |
|---|
| 486 | </p> |
|---|
| 487 | <p id="rfc.section.1.p.2">Host name (HN) means either the host domain name (HDN) or the numeric Internet Protocol (IP) address of a host. The fully |
|---|
| 488 | qualified domain name is preferred; use of numeric IP addresses is strongly discouraged. |
|---|
| 489 | </p> |
|---|
| 490 | <p id="rfc.section.1.p.3">The terms request-host and request-URI refer to the values the client would send to the server as, respectively, the host |
|---|
| 491 | (but not port) and abs_path portions of the absoluteURI (http_URL) of the HTTP request line. Note that request-host is a HN. |
|---|
| 492 | </p> |
|---|
| 493 | <p id="rfc.section.1.p.4">The term effective host name is related to host name. If a host name contains no dots, the effective host name is that name |
|---|
| 494 | with the string .local appended to it. Otherwise the effective host name is the same as the host name. Note that all effective |
|---|
| 495 | host names contain at least one dot. |
|---|
| 496 | </p> |
|---|
| 497 | <p id="rfc.section.1.p.5">The term request-port refers to the port portion of the absoluteURI (http_URL) of the HTTP request line. If the absoluteURI |
|---|
| 498 | has no explicit port, the request-port is the HTTP default, 80. The request-port of a cookie is the request-port of the request |
|---|
| 499 | in which a Set-Cookie2 response header was returned to the user agent. |
|---|
| 500 | </p> |
|---|
| 501 | <p id="rfc.section.1.p.6">Host names can be specified either as an IP address or a HDN string. Sometimes we compare one host name with another. (Such |
|---|
| 502 | comparisons <em class="bcp14">SHALL</em> be case-insensitive.) Host A's name domain-matches host B's if |
|---|
| 503 | </p> |
|---|
| 504 | <ul> |
|---|
| 505 | <li>their host name strings string-compare equal; or</li> |
|---|
| 506 | <li>A is a HDN string and has the form NB, where N is a non-empty name string, B has the form .B', and B' is a HDN string. (So, |
|---|
| 507 | x.y.com domain-matches .Y.com but not Y.com.) |
|---|
| 508 | </li> |
|---|
| 509 | </ul> |
|---|
| 510 | <p id="rfc.section.1.p.7">Note that domain-match is not a commutative operation: a.b.c.com domain-matches .c.com, but not the reverse.</p> |
|---|
| 511 | <p id="rfc.section.1.p.8">The reach R of a host name H is defined as follows: </p> |
|---|
| 512 | <ul> |
|---|
| 513 | <li>If |
|---|
| 514 | <ul> |
|---|
| 515 | <li>H is the host domain name of a host; and,</li> |
|---|
| 516 | <li>H has the form A.B; and</li> |
|---|
| 517 | <li>A has no embedded (that is, interior) dots; and</li> |
|---|
| 518 | <li>B has at least one embedded dot, or B is the string "local". then the reach of H is .B.</li> |
|---|
| 519 | </ul> |
|---|
| 520 | </li> |
|---|
| 521 | <li>Otherwise, the reach of H is H.</li> |
|---|
| 522 | </ul> |
|---|
| 523 | <p id="rfc.section.1.p.9">For two strings that represent paths, P1 and P2, P1 path-matches P2 if P2 is a prefix of P1 (including the case where P1 and |
|---|
| 524 | P2 string- compare equal). Thus, the string /tec/waldo path-matches /tec. |
|---|
| 525 | </p> |
|---|
| 526 | <p id="rfc.section.1.p.10">Because it was used in Netscape's original implementation of state management, we will use the term cookie to refer to the |
|---|
| 527 | state information that passes between an origin server and user agent, and that gets stored by the user agent. |
|---|
| 528 | </p> |
|---|
| 529 | <h2 id="rfc.section.1.1"><a href="#rfc.section.1.1">1.1</a> Requirements |
|---|
| 530 | </h2> |
|---|
| 531 | <p id="rfc.section.1.1.p.1">The key words "MAY", "MUST", "MUST NOT", "OPTIONAL", "RECOMMENDED", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT" |
|---|
| 532 | in this document are to be interpreted as described in RFC 2119 <a href="#RFC2119" id="rfc.xref.RFC2119.1"><cite title="Key words for use in RFCs to Indicate Requirement Levels">[RFC2119]</cite></a>. |
|---|
| 533 | </p> |
|---|
| 534 | <h1 id="rfc.section.2"><a href="#rfc.section.2">2.</a> STATE AND SESSIONS |
|---|
| 535 | </h1> |
|---|
| 536 | <p id="rfc.section.2.p.1">This document describes a way to create stateful sessions with HTTP requests and responses. Currently, HTTP servers respond |
|---|
| 537 | to each client request without relating that request to previous or subsequent requests; the state management mechanism allows |
|---|
| 538 | clients and servers that wish to exchange state information to place HTTP requests and responses within a larger context, |
|---|
| 539 | which we term a "session". This context might be used to create, for example, a "shopping cart", in which user selections |
|---|
| 540 | can be aggregated before purchase, or a magazine browsing system, in which a user's previous reading affects which offerings |
|---|
| 541 | are presented. |
|---|
| 542 | </p> |
|---|
| 543 | <p id="rfc.section.2.p.2">Neither clients nor servers are required to support cookies. A server <em class="bcp14">MAY</em> refuse to provide content to a client that does not return the cookies it sends. |
|---|
| 544 | </p> |
|---|
| 545 | <h1 id="rfc.section.3"><a href="#rfc.section.3">3.</a> DESCRIPTION |
|---|
| 546 | </h1> |
|---|
| 547 | <p id="rfc.section.3.p.1">We describe here a way for an origin server to send state information to the user agent, and for the user agent to return |
|---|
| 548 | the state information to the origin server. The goal is to have a minimal impact on HTTP and user agents. |
|---|
| 549 | </p> |
|---|
| 550 | <h2 id="rfc.section.3.1"><a href="#rfc.section.3.1">3.1</a> Syntax: General |
|---|
| 551 | </h2> |
|---|
| 552 | <p id="rfc.section.3.1.p.1">The two state management headers, Set-Cookie2 and Cookie, have common syntactic properties involving attribute-value pairs. |
|---|
| 553 | The following grammar uses the notation, and tokens DIGIT (decimal digits), token (informally, a sequence of non-special, |
|---|
| 554 | non-white space characters), and http_URL from the HTTP/1.1 specification <a href="#RFC2616" id="rfc.xref.RFC2616.2"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a> to describe their syntax. |
|---|
| 555 | </p> |
|---|
| 556 | <div id="rfc.figure.u.1"></div><pre class="inline"> av-pairs = av-pair *(";" av-pair) |
|---|
| 557 | av-pair = attr ["=" value] ; optional value |
|---|
| 558 | attr = token |
|---|
| 559 | value = token | quoted-string |
|---|
| 560 | </pre><p id="rfc.section.3.1.p.3">Attributes (names) (attr) are case-insensitive. White space is permitted between tokens. Note that while the above syntax |
|---|
| 561 | description shows value as optional, most attrs require them. |
|---|
| 562 | </p> |
|---|
| 563 | <p id="rfc.section.3.1.p.4">NOTE: The syntax above allows whitespace between the attribute and the = sign.</p> |
|---|
| 564 | <h2 id="rfc.section.3.2"><a href="#rfc.section.3.2">3.2</a> Origin Server Role |
|---|
| 565 | </h2> |
|---|
| 566 | <h3 id="rfc.section.3.2.1"><a href="#rfc.section.3.2.1">3.2.1</a> General |
|---|
| 567 | </h3> |
|---|
| 568 | <p id="rfc.section.3.2.1.p.1">The origin server initiates a session, if it so desires. To do so, it returns an extra response header to the client, Set-Cookie2. |
|---|
| 569 | (The details follow later.) |
|---|
| 570 | </p> |
|---|
| 571 | <p id="rfc.section.3.2.1.p.2">A user agent returns a Cookie request header (see below) to the origin server if it chooses to continue a session. The origin |
|---|
| 572 | server <em class="bcp14">MAY</em> ignore it or use it to determine the current state of the session. It <em class="bcp14">MAY</em> send back to the client a Set-Cookie2 response header with the same or different information, or it <em class="bcp14">MAY</em> send no Set-Cookie2 header at all. The origin server effectively ends a session by sending the client a Set-Cookie2 header |
|---|
| 573 | with Max-Age=0. |
|---|
| 574 | </p> |
|---|
| 575 | <p id="rfc.section.3.2.1.p.3">Servers <em class="bcp14">MAY</em> return Set-Cookie2 response headers with any response. User agents <em class="bcp14">SHOULD</em> send Cookie request headers, subject to other rules detailed below, with every request. |
|---|
| 576 | </p> |
|---|
| 577 | <p id="rfc.section.3.2.1.p.4">An origin server <em class="bcp14">MAY</em> include multiple Set-Cookie2 headers in a response. Note that an intervening gateway could fold multiple such headers into |
|---|
| 578 | a single header. |
|---|
| 579 | </p> |
|---|
| 580 | <div id="rfc.iref.s.1"></div> |
|---|
| 581 | <div id="rfc.iref.h.1"></div> |
|---|
| 582 | <h3 id="rfc.section.3.2.2"><a href="#rfc.section.3.2.2">3.2.2</a> Set-Cookie2 Syntax |
|---|
| 583 | </h3> |
|---|
| 584 | <p id="rfc.section.3.2.2.p.1">The syntax for the Set-Cookie2 response header is</p> |
|---|
| 585 | <div id="rfc.figure.u.2"></div><pre class="inline"> set-cookie = "Set-Cookie2:" cookies |
|---|
| 586 | cookies = 1#cookie |
|---|
| 587 | cookie = NAME "=" VALUE *(";" set-cookie-av) |
|---|
| 588 | NAME = attr |
|---|
| 589 | VALUE = value |
|---|
| 590 | set-cookie-av = "Comment" "=" value |
|---|
| 591 | | "CommentURL" "=" <"> http_URL <"> |
|---|
| 592 | | "Discard" |
|---|
| 593 | | "Domain" "=" value |
|---|
| 594 | | "Max-Age" "=" value |
|---|
| 595 | | "Path" "=" value |
|---|
| 596 | | "Port" [ "=" <"> portlist <"> ] |
|---|
| 597 | | "Secure" |
|---|
| 598 | | "Version" "=" 1*DIGIT |
|---|
| 599 | portlist = 1#portnum |
|---|
| 600 | portnum = 1*DIGIT |
|---|
| 601 | </pre><p id="rfc.section.3.2.2.p.3">Informally, the Set-Cookie2 response header comprises the token Set-Cookie2:, followed by a comma-separated list of one or |
|---|
| 602 | more cookies. Each cookie begins with a NAME=VALUE pair, followed by zero or more semi-colon-separated attribute-value pairs. |
|---|
| 603 | The syntax for attribute-value pairs was shown earlier. The specific attributes and the semantics of their values follows. |
|---|
| 604 | The NAME=VALUE attribute-value pair <em class="bcp14">MUST</em> come first in each cookie. The others, if present, can occur in any order. If an attribute appears more than once in a cookie, |
|---|
| 605 | the client <em class="bcp14">SHALL</em> use only the value associated with the first appearance of the attribute; a client <em class="bcp14">MUST</em> ignore values after the first. |
|---|
| 606 | </p> |
|---|
| 607 | <p id="rfc.section.3.2.2.p.4">The NAME of a cookie <em class="bcp14">MAY</em> be the same as one of the attributes in this specification. However, because the cookie's NAME must come first in a Set-Cookie2 |
|---|
| 608 | response header, the NAME and its VALUE cannot be confused with an attribute-value pair. |
|---|
| 609 | </p> |
|---|
| 610 | <p id="rfc.section.3.2.2.p.5"> </p> |
|---|
| 611 | <dl> |
|---|
| 612 | <dt>NAME=VALUE</dt> |
|---|
| 613 | <dd> |
|---|
| 614 | <p> <em class="bcp14">REQUIRED</em>. The name of the state information ("cookie") is NAME, and its value is VALUE. NAMEs that begin with $ are reserved and <em class="bcp14">MUST NOT</em> be used by applications. |
|---|
| 615 | </p> |
|---|
| 616 | <p>The VALUE is opaque to the user agent and may be anything the origin server chooses to send, possibly in a server-selected |
|---|
| 617 | printable ASCII encoding. "Opaque" implies that the content is of interest and relevance only to the origin server. The content |
|---|
| 618 | may, in fact, be readable by anyone that examines the Set-Cookie2 header. |
|---|
| 619 | </p> |
|---|
| 620 | </dd> |
|---|
| 621 | <dt>Comment=value</dt> |
|---|
| 622 | <dd> |
|---|
| 623 | <p> <em class="bcp14">OPTIONAL</em>. Because cookies can be used to derive or store private information about a user, the value of the Comment attribute allows |
|---|
| 624 | an origin server to document how it intends to use the cookie. The user can inspect the information to decide whether to initiate |
|---|
| 625 | or continue a session with this cookie. Characters in value <em class="bcp14">MUST</em> be in UTF-8 encoding. <a href="#RFC2279" id="rfc.xref.RFC2279.1"><cite title="UTF-8, a transformation format of ISO 10646">[RFC2279]</cite></a> |
|---|
| 626 | </p> |
|---|
| 627 | </dd> |
|---|
| 628 | <dt>CommentURL="http_URL"</dt> |
|---|
| 629 | <dd> |
|---|
| 630 | <p> <em class="bcp14">OPTIONAL</em>. Because cookies can be used to derive or store private information about a user, the CommentURL attribute allows an origin |
|---|
| 631 | server to document how it intends to use the cookie. The user can inspect the information identified by the URL to decide |
|---|
| 632 | whether to initiate or continue a session with this cookie. |
|---|
| 633 | </p> |
|---|
| 634 | </dd> |
|---|
| 635 | <dt>Discard</dt> |
|---|
| 636 | <dd> |
|---|
| 637 | <p> <em class="bcp14">OPTIONAL</em>. The Discard attribute instructs the user agent to discard the cookie unconditionally when the user agent terminates. |
|---|
| 638 | </p> |
|---|
| 639 | </dd> |
|---|
| 640 | <dt>Domain=value</dt> |
|---|
| 641 | <dd> |
|---|
| 642 | <p> <em class="bcp14">OPTIONAL</em>. The value of the Domain attribute specifies the domain for which the cookie is valid. If an explicitly specified value does |
|---|
| 643 | not start with a dot, the user agent supplies a leading dot. |
|---|
| 644 | </p> |
|---|
| 645 | </dd> |
|---|
| 646 | <dt>Max-Age=value</dt> |
|---|
| 647 | <dd> |
|---|
| 648 | <p> <em class="bcp14">OPTIONAL</em>. The value of the Max-Age attribute is delta-seconds, the lifetime of the cookie in seconds, a decimal non-negative integer. |
|---|
| 649 | To handle cached cookies correctly, a client <em class="bcp14">SHOULD</em> calculate the age of the cookie according to the age calculation rules in the HTTP/1.1 specification <a href="#RFC2616" id="rfc.xref.RFC2616.3"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>. When the age is greater than delta-seconds seconds, the client <em class="bcp14">SHOULD</em> discard the cookie. A value of zero means the cookie <em class="bcp14">SHOULD</em> be discarded immediately. |
|---|
| 650 | </p> |
|---|
| 651 | </dd> |
|---|
| 652 | <dt>Path=value</dt> |
|---|
| 653 | <dd> |
|---|
| 654 | <p> <em class="bcp14">OPTIONAL</em>. The value of the Path attribute specifies the subset of URLs on the origin server to which this cookie applies. |
|---|
| 655 | </p> |
|---|
| 656 | </dd> |
|---|
| 657 | <dt>Port[="portlist"]</dt> |
|---|
| 658 | <dd> |
|---|
| 659 | <p> <em class="bcp14">OPTIONAL</em>. The Port attribute restricts the port to which a cookie may be returned in a Cookie request header. Note that the syntax |
|---|
| 660 | REQUIREs quotes around the <em class="bcp14">OPTIONAL</em> portlist even if there is only one portnum in portlist. |
|---|
| 661 | </p> |
|---|
| 662 | </dd> |
|---|
| 663 | <dt>Secure</dt> |
|---|
| 664 | <dd> |
|---|
| 665 | <p> <em class="bcp14">OPTIONAL</em>. The Secure attribute (with no value) directs the user agent to use only (unspecified) secure means to contact the origin |
|---|
| 666 | server whenever it sends back this cookie, to protect the confidentially and authenticity of the information in the cookie. |
|---|
| 667 | </p> |
|---|
| 668 | <p>The user agent (possibly with user interaction) <em class="bcp14">MAY</em> determine what level of security it considers appropriate for "secure" cookies. The Secure attribute should be considered |
|---|
| 669 | security advice from the server to the user agent, indicating that it is in the session's interest to protect the cookie contents. |
|---|
| 670 | When it sends a "secure" cookie back to a server, the user agent <em class="bcp14">SHOULD</em> use no less than the same level of security as was used when it received the cookie from the server. |
|---|
| 671 | </p> |
|---|
| 672 | </dd> |
|---|
| 673 | <dt>Version=value</dt> |
|---|
| 674 | <dd> |
|---|
| 675 | <p> <em class="bcp14">REQUIRED</em>. The value of the Version attribute, a decimal integer, identifies the version of the state management specification to which |
|---|
| 676 | the cookie conforms. For this specification, Version=1 applies. |
|---|
| 677 | </p> |
|---|
| 678 | </dd> |
|---|
| 679 | </dl> |
|---|
| 680 | <h3 id="rfc.section.3.2.3"><a href="#rfc.section.3.2.3">3.2.3</a> Controlling Caching |
|---|
| 681 | </h3> |
|---|
| 682 | <p id="rfc.section.3.2.3.p.1">An origin server must be cognizant of the effect of possible caching of both the returned resource and the Set-Cookie2 header. |
|---|
| 683 | Caching "public" documents is desirable. For example, if the origin server wants to use a public document such as a "front |
|---|
| 684 | door" page as a sentinel to indicate the beginning of a session for which a Set-Cookie2 response header must be generated, |
|---|
| 685 | the page <em class="bcp14">SHOULD</em> be stored in caches "pre-expired" so that the origin server will see further requests. "Private documents", for example those |
|---|
| 686 | that contain information strictly private to a session, <em class="bcp14">SHOULD</em> NOT be cached in shared caches. |
|---|
| 687 | </p> |
|---|
| 688 | <p id="rfc.section.3.2.3.p.2">If the cookie is intended for use by a single user, the Set-Cookie2 header <em class="bcp14">SHOULD NOT</em> be cached. A Set-Cookie2 header that is intended to be shared by multiple users <em class="bcp14">MAY</em> be cached. |
|---|
| 689 | </p> |
|---|
| 690 | <p id="rfc.section.3.2.3.p.3">The origin server <em class="bcp14">SHOULD</em> send the following additional HTTP/1.1 response headers, depending on circumstances: |
|---|
| 691 | </p> |
|---|
| 692 | <ul> |
|---|
| 693 | <li>To suppress caching of the Set-Cookie2 header: |
|---|
| 694 | <div id="rfc.figure.u.3"></div><pre class="text"> Cache-control: no-cache="set-cookie2" |
|---|
| 695 | </pre> </li> |
|---|
| 696 | </ul> |
|---|
| 697 | <p id="rfc.section.3.2.3.p.4">and one of the following: </p> |
|---|
| 698 | <ul> |
|---|
| 699 | <li>To suppress caching of a private document in shared caches: |
|---|
| 700 | <div id="rfc.figure.u.4"></div><pre class="text"> Cache-control: private |
|---|
| 701 | </pre> </li> |
|---|
| 702 | <li>To allow caching of a document and require that it be validated before returning it to the client: |
|---|
| 703 | <div id="rfc.figure.u.5"></div><pre class="text"> Cache-Control: must-revalidate, max-age=0 |
|---|
| 704 | </pre> </li> |
|---|
| 705 | <li>To allow caching of a document, but to require that proxy caches (not user agent caches) validate it before returning it to |
|---|
| 706 | the client: |
|---|
| 707 | <div id="rfc.figure.u.6"></div><pre class="text"> Cache-Control: proxy-revalidate, max-age=0 |
|---|
| 708 | </pre> </li> |
|---|
| 709 | <li>To allow caching of a document and request that it be validated before returning it to the client (by "pre-expiring" it): |
|---|
| 710 | <div id="rfc.figure.u.7"></div><pre class="text"> Cache-control: max-age=0 |
|---|
| 711 | </pre> Not all caches will revalidate the document in every case.</li> |
|---|
| 712 | </ul> |
|---|
| 713 | <p id="rfc.section.3.2.3.p.5">HTTP/1.1 servers <em class="bcp14">MUST</em> send Expires: old-date (where old-date is a date long in the past) on responses containing Set-Cookie2 response headers unless |
|---|
| 714 | they know for certain (by out of band means) that there are no HTTP/1.0 proxies in the response chain. HTTP/1.1 servers <em class="bcp14">MAY</em> send other Cache-Control directives that permit caching by HTTP/1.1 proxies in addition to the Expires: old-date directive; |
|---|
| 715 | the Cache-Control directive will override the Expires: old-date for HTTP/1.1 proxies. |
|---|
| 716 | </p> |
|---|
| 717 | <h2 id="rfc.section.3.3"><a href="#rfc.section.3.3">3.3</a> User Agent Role |
|---|
| 718 | </h2> |
|---|
| 719 | <h3 id="rfc.section.3.3.1"><a href="#rfc.section.3.3.1">3.3.1</a> Interpreting Set-Cookie2 |
|---|
| 720 | </h3> |
|---|
| 721 | <p id="rfc.section.3.3.1.p.1">The user agent keeps separate track of state information that arrives via Set-Cookie2 response headers from each origin server |
|---|
| 722 | (as distinguished by name or IP address and port). The user agent <em class="bcp14">MUST</em> ignore attribute-value pairs whose attribute it does not recognize. The user agent applies these defaults for optional attributes |
|---|
| 723 | that are missing: |
|---|
| 724 | </p> |
|---|
| 725 | <p id="rfc.section.3.3.1.p.2"> </p> |
|---|
| 726 | <dl> |
|---|
| 727 | <dt>Discard</dt> |
|---|
| 728 | <dd>The default behavior is dictated by the presence or absence of a Max-Age attribute.</dd> |
|---|
| 729 | <dt>Domain</dt> |
|---|
| 730 | <dd>Defaults to the effective request-host. (Note that because there is no dot at the beginning of effective request-host, the |
|---|
| 731 | default Domain can only domain-match itself.) |
|---|
| 732 | </dd> |
|---|
| 733 | <dt>Max-Age</dt> |
|---|
| 734 | <dd>The default behavior is to discard the cookie when the user agent exits.</dd> |
|---|
| 735 | <dt>Path</dt> |
|---|
| 736 | <dd>Defaults to the path of the request URL that generated the Set-Cookie2 response, up to and including the right-most /.</dd> |
|---|
| 737 | <dt>Port</dt> |
|---|
| 738 | <dd>The default behavior is that a cookie <em class="bcp14">MAY</em> be returned to any request-port. |
|---|
| 739 | </dd> |
|---|
| 740 | <dt>Secure</dt> |
|---|
| 741 | <dd>If absent, the user agent <em class="bcp14">MAY</em> send the cookie over an insecure channel. |
|---|
| 742 | </dd> |
|---|
| 743 | </dl> |
|---|
| 744 | <h3 id="rfc.section.3.3.2"><a href="#rfc.section.3.3.2">3.3.2</a> Rejecting Cookies |
|---|
| 745 | </h3> |
|---|
| 746 | <p id="rfc.section.3.3.2.p.1">To prevent possible security or privacy violations, a user agent rejects a cookie according to rules below. The goal of the |
|---|
| 747 | rules is to try to limit the set of servers for which a cookie is valid, based on the values of the Path, Domain, and Port |
|---|
| 748 | attributes and the request-URI, request-host and request-port. |
|---|
| 749 | </p> |
|---|
| 750 | <p id="rfc.section.3.3.2.p.2">A user agent rejects (<em class="bcp14">SHALL NOT</em> store its information) if the Version attribute is missing. Moreover, a user agent rejects (<em class="bcp14">SHALL NOT</em> store its information) if any of the following is true of the attributes explicitly present in the Set-Cookie2 response header: |
|---|
| 751 | </p> |
|---|
| 752 | <ul> |
|---|
| 753 | <li>The value for the Path attribute is not a prefix of the request-URI.</li> |
|---|
| 754 | <li>The value for the Domain attribute contains no embedded dots, and the value is not .local.</li> |
|---|
| 755 | <li>The effective host name that derives from the request-host does not domain-match the Domain attribute.</li> |
|---|
| 756 | <li>The request-host is a HDN (not IP address) and has the form HD, where D is the value of the Domain attribute, and H is a string |
|---|
| 757 | that contains one or more dots. |
|---|
| 758 | </li> |
|---|
| 759 | <li>The Port attribute has a "port-list", and the request-port was not in the list.</li> |
|---|
| 760 | </ul> |
|---|
| 761 | <p id="rfc.section.3.3.2.p.3">Examples: </p> |
|---|
| 762 | <ul> |
|---|
| 763 | <li>A Set-Cookie2 from request-host y.x.foo.com for Domain=.foo.com would be rejected, because H is y.x and contains a dot.</li> |
|---|
| 764 | <li>A Set-Cookie2 from request-host x.foo.com for Domain=.foo.com would be accepted.</li> |
|---|
| 765 | <li>A Set-Cookie2 with Domain=.com or Domain=.com., will always be rejected, because there is no embedded dot.</li> |
|---|
| 766 | <li>A Set-Cookie2 with Domain=ajax.com will be accepted, and the value for Domain will be taken to be .ajax.com, because a dot |
|---|
| 767 | gets prepended to the value. |
|---|
| 768 | </li> |
|---|
| 769 | <li>A Set-Cookie2 with Port="80,8000" will be accepted if the request was made to port 80 or 8000 and will be rejected otherwise.</li> |
|---|
| 770 | <li>A Set-Cookie2 from request-host example for Domain=.local will be accepted, because the effective host name for the request- |
|---|
| 771 | host is example.local, and example.local domain-matches .local. |
|---|
| 772 | </li> |
|---|
| 773 | </ul> |
|---|
| 774 | <h3 id="rfc.section.3.3.3"><a href="#rfc.section.3.3.3">3.3.3</a> Cookie Management |
|---|
| 775 | </h3> |
|---|
| 776 | <p id="rfc.section.3.3.3.p.1">If a user agent receives a Set-Cookie2 response header whose NAME is the same as that of a cookie it has previously stored, |
|---|
| 777 | the new cookie supersedes the old when: the old and new Domain attribute values compare equal, using a case-insensitive string-compare; |
|---|
| 778 | and, the old and new Path attribute values string-compare equal (case-sensitive). However, if the Set-Cookie2 has a value |
|---|
| 779 | for Max-Age of zero, the (old and new) cookie is discarded. Otherwise a cookie persists (resources permitting) until whichever |
|---|
| 780 | happens first, then gets discarded: its Max-Age lifetime is exceeded; or, if the Discard attribute is set, the user agent |
|---|
| 781 | terminates the session. |
|---|
| 782 | </p> |
|---|
| 783 | <p id="rfc.section.3.3.3.p.2">Because user agents have finite space in which to store cookies, they <em class="bcp14">MAY</em> also discard older cookies to make space for newer ones, using, for example, a least-recently-used algorithm, along with constraints |
|---|
| 784 | on the maximum number of cookies that each origin server may set. |
|---|
| 785 | </p> |
|---|
| 786 | <p id="rfc.section.3.3.3.p.3">If a Set-Cookie2 response header includes a Comment attribute, the user agent <em class="bcp14">SHOULD</em> store that information in a human-readable form with the cookie and <em class="bcp14">SHOULD</em> display the comment text as part of a cookie inspection user interface. |
|---|
| 787 | </p> |
|---|
| 788 | <p id="rfc.section.3.3.3.p.4">If a Set-Cookie2 response header includes a CommentURL attribute, the user agent <em class="bcp14">SHOULD</em> store that information in a human-readable form with the cookie, or, preferably, <em class="bcp14">SHOULD</em> allow the user to follow the http_URL link as part of a cookie inspection user interface. |
|---|
| 789 | </p> |
|---|
| 790 | <p id="rfc.section.3.3.3.p.5">The cookie inspection user interface may include a facility whereby a user can decide, at the time the user agent receives |
|---|
| 791 | the Set-Cookie2 response header, whether or not to accept the cookie. A potentially confusing situation could arise if the |
|---|
| 792 | following sequence occurs: |
|---|
| 793 | </p> |
|---|
| 794 | <ul> |
|---|
| 795 | <li>the user agent receives a cookie that contains a CommentURL attribute;</li> |
|---|
| 796 | <li>the user agent's cookie inspection interface is configured so that it presents a dialog to the user before the user agent |
|---|
| 797 | accepts the cookie; |
|---|
| 798 | </li> |
|---|
| 799 | <li>the dialog allows the user to follow the CommentURL link when the user agent receives the cookie; and,</li> |
|---|
| 800 | <li>when the user follows the CommentURL link, the origin server (or another server, via other links in the returned content) |
|---|
| 801 | returns another cookie. |
|---|
| 802 | </li> |
|---|
| 803 | </ul> |
|---|
| 804 | <p id="rfc.section.3.3.3.p.6">The user agent <em class="bcp14">SHOULD NOT</em> send any cookies in this context. The user agent <em class="bcp14">MAY</em> discard any cookie it receives in this context that the user has not, through some user agent mechanism, deemed acceptable. |
|---|
| 805 | </p> |
|---|
| 806 | <p id="rfc.section.3.3.3.p.7">User agents <em class="bcp14">SHOULD</em> allow the user to control cookie destruction, but they <em class="bcp14">MUST NOT</em> extend the cookie's lifetime beyond that controlled by the Discard and Max-Age attributes. An infrequently-used cookie may |
|---|
| 807 | function as a "preferences file" for network applications, and a user may wish to keep it even if it is the least-recently-used |
|---|
| 808 | cookie. One possible implementation would be an interface that allows the permanent storage of a cookie through a checkbox |
|---|
| 809 | (or, conversely, its immediate destruction). |
|---|
| 810 | </p> |
|---|
| 811 | <p id="rfc.section.3.3.3.p.8">Privacy considerations dictate that the user have considerable control over cookie management. The PRIVACY section contains |
|---|
| 812 | more information. |
|---|
| 813 | </p> |
|---|
| 814 | <div id="rfc.iref.c.1"></div> |
|---|
| 815 | <div id="rfc.iref.h.2"></div> |
|---|
| 816 | <h3 id="rfc.section.3.3.4"><a href="#rfc.section.3.3.4">3.3.4</a> Sending Cookies to the Origin Server |
|---|
| 817 | </h3> |
|---|
| 818 | <p id="rfc.section.3.3.4.p.1">When it sends a request to an origin server, the user agent includes a Cookie request header if it has stored cookies that |
|---|
| 819 | are applicable to the request, based on |
|---|
| 820 | </p> |
|---|
| 821 | <ul> |
|---|
| 822 | <li>the request-host and request-port;</li> |
|---|
| 823 | <li>the request-URI;</li> |
|---|
| 824 | <li>the cookie's age.</li> |
|---|
| 825 | </ul> |
|---|
| 826 | <div id="rfc.figure.u.8"></div> |
|---|
| 827 | <p>The syntax for the header is:</p><pre class="inline">cookie = "Cookie:" cookie-version 1*((";" | ",") cookie-value) |
|---|
| 828 | cookie-value = NAME "=" VALUE [";" path] [";" domain] [";" port] |
|---|
| 829 | cookie-version = "$Version" "=" value |
|---|
| 830 | NAME = attr |
|---|
| 831 | VALUE = value |
|---|
| 832 | path = "$Path" "=" value |
|---|
| 833 | domain = "$Domain" "=" value |
|---|
| 834 | port = "$Port" [ "=" <"> value <"> ] |
|---|
| 835 | </pre><p id="rfc.section.3.3.4.p.3">The value of the cookie-version attribute <em class="bcp14">MUST</em> be the value from the Version attribute of the corresponding Set-Cookie2 response header. Otherwise the value for cookie-version |
|---|
| 836 | is 0. The value for the path attribute <em class="bcp14">MUST</em> be the value from the Path attribute, if one was present, of the corresponding Set-Cookie2 response header. Otherwise the |
|---|
| 837 | attribute <em class="bcp14">SHOULD</em> be omitted from the Cookie request header. The value for the domain attribute <em class="bcp14">MUST</em> be the value from the Domain attribute, if one was present, of the corresponding Set-Cookie2 response header. Otherwise the |
|---|
| 838 | attribute <em class="bcp14">SHOULD</em> be omitted from the Cookie request header. |
|---|
| 839 | </p> |
|---|
| 840 | <p id="rfc.section.3.3.4.p.4">The port attribute of the Cookie request header <em class="bcp14">MUST</em> mirror the Port attribute, if one was present, in the corresponding Set-Cookie2 response header. That is, the port attribute <em class="bcp14">MUST</em> be present if the Port attribute was present in the Set-Cookie2 header, and it <em class="bcp14">MUST</em> have the same value, if any. Otherwise, if the Port attribute was absent from the Set-Cookie2 header, the attribute likewise <em class="bcp14">MUST</em> be omitted from the Cookie request header. |
|---|
| 841 | </p> |
|---|
| 842 | <p id="rfc.section.3.3.4.p.5">Note that there is neither a Comment nor a CommentURL attribute in the Cookie request header corresponding to the ones in |
|---|
| 843 | the Set-Cookie2 response header. The user agent does not return the comment information to the origin server. |
|---|
| 844 | </p> |
|---|
| 845 | <p id="rfc.section.3.3.4.p.6">The user agent applies the following rules to choose applicable cookie-values to send in Cookie request headers from among |
|---|
| 846 | all the cookies it has received. |
|---|
| 847 | </p> |
|---|
| 848 | <dl> |
|---|
| 849 | <dt>Domain Selection</dt> |
|---|
| 850 | <dd>The origin server's effective host name <em class="bcp14">MUST</em> domain-match the Domain attribute of the cookie. |
|---|
| 851 | </dd> |
|---|
| 852 | <dt>Port Selection</dt> |
|---|
| 853 | <dd>There are three possible behaviors, depending on the Port attribute in the Set-Cookie2 response header: |
|---|
| 854 | <ol> |
|---|
| 855 | <li>By default (no Port attribute), the cookie <em class="bcp14">MAY</em> be sent to any port. |
|---|
| 856 | </li> |
|---|
| 857 | <li>If the attribute is present but has no value (e.g., Port), the cookie <em class="bcp14">MUST</em> only be sent to the request-port it was received from. |
|---|
| 858 | </li> |
|---|
| 859 | <li>If the attribute has a port-list, the cookie <em class="bcp14">MUST</em> only be returned if the new request-port is one of those listed in port-list. |
|---|
| 860 | </li> |
|---|
| 861 | </ol> |
|---|
| 862 | </dd> |
|---|
| 863 | <dt>Path Selection</dt> |
|---|
| 864 | <dd>The request-URI <em class="bcp14">MUST</em> path-match the Path attribute of the cookie. |
|---|
| 865 | </dd> |
|---|
| 866 | <dt>Max-Age Selection</dt> |
|---|
| 867 | <dd>Cookies that have expired should have been discarded and thus are not forwarded to an origin server.</dd> |
|---|
| 868 | </dl> |
|---|
| 869 | <p id="rfc.section.3.3.4.p.7">If multiple cookies satisfy the criteria above, they are ordered in the Cookie header such that those with more specific Path |
|---|
| 870 | attributes precede those with less specific. Ordering with respect to other attributes (e.g., Domain) is unspecified. |
|---|
| 871 | </p> |
|---|
| 872 | <p id="rfc.section.3.3.4.p.8">Note: For backward compatibility, the separator in the Cookie header is semi-colon (;) everywhere. A server <em class="bcp14">SHOULD</em> also accept comma (,) as the separator between cookie-values for future compatibility. |
|---|
| 873 | </p> |
|---|
| 874 | <div id="rfc.iref.c.2"></div> |
|---|
| 875 | <div id="rfc.iref.h.3"></div> |
|---|
| 876 | <h3 id="rfc.section.3.3.5"><a href="#rfc.section.3.3.5">3.3.5</a> Identifying What Version is Understood: Cookie2 |
|---|
| 877 | </h3> |
|---|
| 878 | <p id="rfc.section.3.3.5.p.1">The Cookie2 request header facilitates interoperation between clients and servers that understand different versions of the |
|---|
| 879 | cookie specification. When the client sends one or more cookies to an origin server, if at least one of those cookies contains |
|---|
| 880 | a $Version attribute whose value is different from the version that the client understands, then the client <em class="bcp14">MUST</em> also send a Cookie2 request header, the syntax for which is |
|---|
| 881 | </p> |
|---|
| 882 | <div id="rfc.figure.u.9"></div><pre class="inline"> cookie2 = "Cookie2:" cookie-version |
|---|
| 883 | </pre><p id="rfc.section.3.3.5.p.3">Here the value for cookie-version is the highest version of cookie specification (currently 1) that the client understands. |
|---|
| 884 | The client needs to send at most one such request header per request. |
|---|
| 885 | </p> |
|---|
| 886 | <h3 id="rfc.section.3.3.6"><a href="#rfc.section.3.3.6">3.3.6</a> Sending Cookies in Unverifiable Transactions |
|---|
| 887 | </h3> |
|---|
| 888 | <p id="rfc.section.3.3.6.p.1">Users <em class="bcp14">MUST</em> have control over sessions in order to ensure privacy. (See PRIVACY section below.) To simplify implementation and to prevent |
|---|
| 889 | an additional layer of complexity where adequate safeguards exist, however, this document distinguishes between transactions |
|---|
| 890 | that are verifiable and those that are unverifiable. A transaction is verifiable if the user, or a user-designated agent, |
|---|
| 891 | has the option to review the request-URI prior to its use in the transaction. A transaction is unverifiable if the user does |
|---|
| 892 | not have that option. Unverifiable transactions typically arise when a user agent automatically requests inlined or embedded |
|---|
| 893 | entities or when it resolves redirection (3xx) responses from an origin server. Typically the origin transaction, the transaction |
|---|
| 894 | that the user initiates, is verifiable, and that transaction may directly or indirectly induce the user agent to make unverifiable |
|---|
| 895 | transactions. |
|---|
| 896 | </p> |
|---|
| 897 | <p id="rfc.section.3.3.6.p.2">An unverifiable transaction is to a third-party host if its request-host U does not domain-match the reach R of the request-host |
|---|
| 898 | O in the origin transaction. |
|---|
| 899 | </p> |
|---|
| 900 | <p id="rfc.section.3.3.6.p.3">When it makes an unverifiable transaction, a user agent <em class="bcp14">MUST</em> disable all cookie processing (i.e., <em class="bcp14">MUST NOT</em> send cookies, and <em class="bcp14">MUST NOT</em> accept any received cookies) if the transaction is to a third-party host. |
|---|
| 901 | </p> |
|---|
| 902 | <p id="rfc.section.3.3.6.p.4">This restriction prevents a malicious service author from using unverifiable transactions to induce a user agent to start |
|---|
| 903 | or continue a session with a server in a different domain. The starting or continuation of such sessions could be contrary |
|---|
| 904 | to the privacy expectations of the user, and could also be a security problem. |
|---|
| 905 | </p> |
|---|
| 906 | <p id="rfc.section.3.3.6.p.5">User agents <em class="bcp14">MAY</em> offer configurable options that allow the user agent, or any autonomous programs that the user agent executes, to ignore the |
|---|
| 907 | above rule, so long as these override options default to "off". |
|---|
| 908 | </p> |
|---|
| 909 | <p id="rfc.section.3.3.6.p.6">(N.B. Mechanisms may be proposed that will automate overriding the third-party restrictions under controlled conditions.)</p> |
|---|
| 910 | <p id="rfc.section.3.3.6.p.7">Many current user agents already provide a review option that would render many links verifiable. For instance, some user |
|---|
| 911 | agents display the URL that would be referenced for a particular link when the mouse pointer is placed over that link. The |
|---|
| 912 | user can therefore determine whether to visit that site before causing the browser to do so. (Though not implemented on current |
|---|
| 913 | user agents, a similar technique could be used for a button used to submit a form -- the user agent could display the action |
|---|
| 914 | to be taken if the user were to select that button.) However, even this would not make all links verifiable; for example, |
|---|
| 915 | links to automatically loaded images would not normally be subject to "mouse pointer" verification. |
|---|
| 916 | </p> |
|---|
| 917 | <p id="rfc.section.3.3.6.p.8">Many user agents also provide the option for a user to view the HTML source of a document, or to save the source to an external |
|---|
| 918 | file where it can be viewed by another application. While such an option does provide a crude review mechanism, some users |
|---|
| 919 | might not consider it acceptable for this purpose. |
|---|
| 920 | </p> |
|---|
| 921 | <h2 id="rfc.section.3.4"><a href="#rfc.section.3.4">3.4</a> How an Origin Server Interprets the Cookie Header |
|---|
| 922 | </h2> |
|---|
| 923 | <p id="rfc.section.3.4.p.1">A user agent returns much of the information in the Set-Cookie2 header to the origin server when the request-URI path-matches |
|---|
| 924 | the Path attribute of the cookie. When it receives a Cookie header, the origin server <em class="bcp14">SHOULD</em> treat cookies with NAMEs whose prefix is $ specially, as an attribute for the cookie. |
|---|
| 925 | </p> |
|---|
| 926 | <h2 id="rfc.section.3.5"><a href="#rfc.section.3.5">3.5</a> Caching Proxy Role |
|---|
| 927 | </h2> |
|---|
| 928 | <p id="rfc.section.3.5.p.1">One reason for separating state information from both a URL and document content is to facilitate the scaling that caching |
|---|
| 929 | permits. To support cookies, a caching proxy <em class="bcp14">MUST</em> obey these rules already in the HTTP specification: |
|---|
| 930 | </p> |
|---|
| 931 | <ul> |
|---|
| 932 | <li>Honor requests from the cache, if possible, based on cache validity rules.</li> |
|---|
| 933 | <li>Pass along a Cookie request header in any request that the proxy must make of another server.</li> |
|---|
| 934 | <li>Return the response to the client. Include any Set-Cookie2 response header.</li> |
|---|
| 935 | <li>Cache the received response subject to the control of the usual headers, such as Expires, |
|---|
| 936 | <div id="rfc.figure.u.10"></div><pre class="text"> Cache-control: no-cache |
|---|
| 937 | </pre> and <div id="rfc.figure.u.11"></div><pre class="text"> Cache-control: private |
|---|
| 938 | </pre> </li> |
|---|
| 939 | <li>Cache the Set-Cookie2 subject to the control of the usual header, |
|---|
| 940 | <div id="rfc.figure.u.12"></div><pre class="text"> Cache-control: no-cache="set-cookie2" |
|---|
| 941 | </pre> (The Set-Cookie2 header should usually not be cached.)</li> |
|---|
| 942 | </ul> |
|---|
| 943 | <p id="rfc.section.3.5.p.2">Proxies <em class="bcp14">MUST NOT</em> introduce Set-Cookie2 (Cookie) headers of their own in proxy responses (requests). |
|---|
| 944 | </p> |
|---|
| 945 | <h1 id="rfc.section.4"><a href="#rfc.section.4">4.</a> EXAMPLES |
|---|
| 946 | </h1> |
|---|
| 947 | <h2 id="rfc.section.4.1"><a href="#rfc.section.4.1">4.1</a> Example 1 |
|---|
| 948 | </h2> |
|---|
| 949 | <p id="rfc.section.4.1.p.1">Most detail of request and response headers has been omitted. Assume the user agent has no stored cookies.</p> |
|---|
| 950 | <p id="rfc.section.4.1.p.2">1. User Agent -> Server</p> |
|---|
| 951 | <div id="rfc.figure.u.13"></div><pre class="text2"> POST /acme/login HTTP/1.1 |
|---|
| 952 | [form data] |
|---|
| 953 | </pre><p id="rfc.section.4.1.p.4">User identifies self via a form.</p> |
|---|
| 954 | <p id="rfc.section.4.1.p.5">2. Server -> User Agent</p> |
|---|
| 955 | <div id="rfc.figure.u.14"></div><pre class="text"> HTTP/1.1 200 OK |
|---|
| 956 | Set-Cookie2: Customer="WILE_E_COYOTE"; Version="1"; Path="/acme" |
|---|
| 957 | </pre><p id="rfc.section.4.1.p.7">Cookie reflects user's identity.</p> |
|---|
| 958 | <p id="rfc.section.4.1.p.8">3. User Agent -> Server</p> |
|---|
| 959 | <div id="rfc.figure.u.15"></div><pre class="text2"> POST /acme/pickitem HTTP/1.1 |
|---|
| 960 | Cookie: $Version="1"; Customer="WILE_E_COYOTE"; $Path="/acme" |
|---|
| 961 | [form data] |
|---|
| 962 | </pre><p id="rfc.section.4.1.p.10">User selects an item for "shopping basket".</p> |
|---|
| 963 | <p id="rfc.section.4.1.p.11">4. Server -> User Agent</p> |
|---|
| 964 | <div id="rfc.figure.u.16"></div><pre class="text"> HTTP/1.1 200 OK |
|---|
| 965 | Set-Cookie2: Part_Number="Rocket_Launcher_0001"; Version="1"; |
|---|
| 966 | Path="/acme" |
|---|
| 967 | </pre><p id="rfc.section.4.1.p.13">Shopping basket contains an item.</p> |
|---|
| 968 | <p id="rfc.section.4.1.p.14">5. User Agent -> Server</p> |
|---|
| 969 | <div id="rfc.figure.u.17"></div><pre class="text2"> POST /acme/shipping HTTP/1.1 |
|---|
| 970 | Cookie: $Version="1"; |
|---|
| 971 | Customer="WILE_E_COYOTE"; $Path="/acme"; |
|---|
| 972 | Part_Number="Rocket_Launcher_0001"; $Path="/acme" |
|---|
| 973 | [form data] |
|---|
| 974 | </pre><p id="rfc.section.4.1.p.16">User selects shipping method from form.</p> |
|---|
| 975 | <p id="rfc.section.4.1.p.17">6. Server -> User Agent</p> |
|---|
| 976 | <div id="rfc.figure.u.18"></div><pre class="text"> HTTP/1.1 200 OK |
|---|
| 977 | Set-Cookie2: Shipping="FedEx"; Version="1"; Path="/acme" |
|---|
| 978 | </pre><p id="rfc.section.4.1.p.19">New cookie reflects shipping method.</p> |
|---|
| 979 | <p id="rfc.section.4.1.p.20">7. User Agent -> Server</p> |
|---|
| 980 | <div id="rfc.figure.u.19"></div><pre class="text2"> POST /acme/process HTTP/1.1 |
|---|
| 981 | Cookie: $Version="1"; |
|---|
| 982 | Customer="WILE_E_COYOTE"; $Path="/acme"; |
|---|
| 983 | Part_Number="Rocket_Launcher_0001"; $Path="/acme"; |
|---|
| 984 | Shipping="FedEx"; $Path="/acme" |
|---|
| 985 | [form data] |
|---|
| 986 | </pre><p id="rfc.section.4.1.p.22">User chooses to process order.</p> |
|---|
| 987 | <p id="rfc.section.4.1.p.23">8. Server -> User Agent</p> |
|---|
| 988 | <div id="rfc.figure.u.20"></div><pre class="text"> HTTP/1.1 200 OK |
|---|
| 989 | </pre><p id="rfc.section.4.1.p.25">Transaction is complete.</p> |
|---|
| 990 | <p id="rfc.section.4.1.p.26">The user agent makes a series of requests on the origin server, after each of which it receives a new cookie. All the cookies |
|---|
| 991 | have the same Path attribute and (default) domain. Because the request-URIs all path-match /acme, the Path attribute of each |
|---|
| 992 | cookie, each request contains all the cookies received so far. |
|---|
| 993 | </p> |
|---|
| 994 | <h2 id="rfc.section.4.2"><a href="#rfc.section.4.2">4.2</a> Example 2 |
|---|
| 995 | </h2> |
|---|
| 996 | <p id="rfc.section.4.2.p.1">This example illustrates the effect of the Path attribute. All detail of request and response headers has been omitted. Assume |
|---|
| 997 | the user agent has no stored cookies. |
|---|
| 998 | </p> |
|---|
| 999 | <p id="rfc.section.4.2.p.2">Imagine the user agent has received, in response to earlier requests, the response headers</p> |
|---|
| 1000 | <div id="rfc.figure.u.21"></div><pre class="text"> Set-Cookie2: Part_Number="Rocket_Launcher_0001"; Version="1"; |
|---|
| 1001 | Path="/acme" |
|---|
| 1002 | </pre><p id="rfc.section.4.2.p.4">and</p> |
|---|
| 1003 | <div id="rfc.figure.u.22"></div><pre class="text"> Set-Cookie2: Part_Number="Riding_Rocket_0023"; Version="1"; |
|---|
| 1004 | Path="/acme/ammo" |
|---|
| 1005 | </pre><p id="rfc.section.4.2.p.6">A subsequent request by the user agent to the (same) server for URLs of the form /acme/ammo/... would include the following |
|---|
| 1006 | request header: |
|---|
| 1007 | </p> |
|---|
| 1008 | <div id="rfc.figure.u.23"></div><pre class="text"> Cookie: $Version="1"; |
|---|
| 1009 | Part_Number="Riding_Rocket_0023"; $Path="/acme/ammo"; |
|---|
| 1010 | Part_Number="Rocket_Launcher_0001"; $Path="/acme" |
|---|
| 1011 | </pre><p id="rfc.section.4.2.p.8">Note that the NAME=VALUE pair for the cookie with the more specific Path attribute, /acme/ammo, comes before the one with |
|---|
| 1012 | the less specific Path attribute, /acme. Further note that the same cookie name appears more than once. |
|---|
| 1013 | </p> |
|---|
| 1014 | <p id="rfc.section.4.2.p.9">A subsequent request by the user agent to the (same) server for a URL of the form /acme/parts/ would include the following |
|---|
| 1015 | request header: |
|---|
| 1016 | </p> |
|---|
| 1017 | <div id="rfc.figure.u.24"></div><pre class="text"> Cookie: $Version="1"; Part_Number="Rocket_Launcher_0001"; |
|---|
| 1018 | $Path="/acme" |
|---|
| 1019 | </pre><p id="rfc.section.4.2.p.11">Here, the second cookie's Path attribute /acme/ammo is not a prefix of the request URL, /acme/parts/, so the cookie does not |
|---|
| 1020 | get forwarded to the server. |
|---|
| 1021 | </p> |
|---|
| 1022 | <h1 id="rfc.section.5"><a href="#rfc.section.5">5.</a> IMPLEMENTATION CONSIDERATIONS |
|---|
| 1023 | </h1> |
|---|
| 1024 | <p id="rfc.section.5.p.1">Here we provide guidance on likely or desirable details for an origin server that implements state management.</p> |
|---|
| 1025 | <h2 id="rfc.section.5.1"><a href="#rfc.section.5.1">5.1</a> Set-Cookie2 Content |
|---|
| 1026 | </h2> |
|---|
| 1027 | <p id="rfc.section.5.1.p.1">An origin server's content should probably be divided into disjoint application areas, some of which require the use of state |
|---|
| 1028 | information. The application areas can be distinguished by their request URLs. The Set-Cookie2 header can incorporate information |
|---|
| 1029 | about the application areas by setting the Path attribute for each one. |
|---|
| 1030 | </p> |
|---|
| 1031 | <p id="rfc.section.5.1.p.2">The session information can obviously be clear or encoded text that describes state. However, if it grows too large, it can |
|---|
| 1032 | become unwieldy. Therefore, an implementor might choose for the session information to be a key to a server-side resource. |
|---|
| 1033 | Of course, using a database creates some problems that this state management specification was meant to avoid, namely: |
|---|
| 1034 | </p> |
|---|
| 1035 | <ol> |
|---|
| 1036 | <li>keeping real state on the server side;</li> |
|---|
| 1037 | <li>how and when to garbage-collect the database entry, in case the user agent terminates the session by, for example, exiting.</li> |
|---|
| 1038 | </ol> |
|---|
| 1039 | <h2 id="rfc.section.5.2"><a href="#rfc.section.5.2">5.2</a> Stateless Pages |
|---|
| 1040 | </h2> |
|---|
| 1041 | <p id="rfc.section.5.2.p.1">Caching benefits the scalability of WWW. Therefore it is important to reduce the number of documents that have state embedded |
|---|
| 1042 | in them inherently. For example, if a shopping-basket-style application always displays a user's current basket contents on |
|---|
| 1043 | each page, those pages cannot be cached, because each user's basket's contents would be different. On the other hand, if each |
|---|
| 1044 | page contains just a link that allows the user to "Look at My Shopping Basket", the page can be cached. |
|---|
| 1045 | </p> |
|---|
| 1046 | <h2 id="rfc.section.5.3"><a href="#rfc.section.5.3">5.3</a> Implementation Limits |
|---|
| 1047 | </h2> |
|---|
| 1048 | <p id="rfc.section.5.3.p.1">Practical user agent implementations have limits on the number and size of cookies that they can store. In general, user agents' |
|---|
| 1049 | cookie support should have no fixed limits. They should strive to store as many frequently-used cookies as possible. Furthermore, |
|---|
| 1050 | general-use user agents <em class="bcp14">SHOULD</em> provide each of the following minimum capabilities individually, although not necessarily simultaneously: |
|---|
| 1051 | </p> |
|---|
| 1052 | <ul> |
|---|
| 1053 | <li>at least 300 cookies</li> |
|---|
| 1054 | <li>at least 4096 bytes per cookie (as measured by the characters that comprise the cookie non-terminal in the syntax description |
|---|
| 1055 | of the Set-Cookie2 header, and as received in the Set-Cookie2 header) |
|---|
| 1056 | </li> |
|---|
| 1057 | <li>at least 20 cookies per unique host or domain name</li> |
|---|
| 1058 | </ul> |
|---|
| 1059 | <p id="rfc.section.5.3.p.2">User agents created for specific purposes or for limited-capacity devices <em class="bcp14">SHOULD</em> provide at least 20 cookies of 4096 bytes, to ensure that the user can interact with a session-based origin server. |
|---|
| 1060 | </p> |
|---|
| 1061 | <p id="rfc.section.5.3.p.3">The information in a Set-Cookie2 response header <em class="bcp14">MUST</em> be retained in its entirety. If for some reason there is inadequate space to store the cookie, it <em class="bcp14">MUST</em> be discarded, not truncated. |
|---|
| 1062 | </p> |
|---|
| 1063 | <p id="rfc.section.5.3.p.4">Applications should use as few and as small cookies as possible, and they should cope gracefully with the loss of a cookie.</p> |
|---|
| 1064 | <h3 id="rfc.section.5.3.1"><a href="#rfc.section.5.3.1">5.3.1</a> Denial of Service Attacks |
|---|
| 1065 | </h3> |
|---|
| 1066 | <p id="rfc.section.5.3.1.p.1">User agents <em class="bcp14">MAY</em> choose to set an upper bound on the number of cookies to be stored from a given host or domain name or on the size of the |
|---|
| 1067 | cookie information. Otherwise a malicious server could attempt to flood a user agent with many cookies, or large cookies, |
|---|
| 1068 | on successive responses, which would force out cookies the user agent had received from other servers. However, the minima |
|---|
| 1069 | specified above <em class="bcp14">SHOULD</em> still be supported. |
|---|
| 1070 | </p> |
|---|
| 1071 | <h1 id="rfc.section.6"><a href="#rfc.section.6">6.</a> PRIVACY |
|---|
| 1072 | </h1> |
|---|
| 1073 | <p id="rfc.section.6.p.1">Informed consent should guide the design of systems that use cookies. A user should be able to find out how a web site plans |
|---|
| 1074 | to use information in a cookie and should be able to choose whether or not those policies are acceptable. Both the user agent |
|---|
| 1075 | and the origin server must assist informed consent. |
|---|
| 1076 | </p> |
|---|
| 1077 | <h2 id="rfc.section.6.1"><a href="#rfc.section.6.1">6.1</a> User Agent Control |
|---|
| 1078 | </h2> |
|---|
| 1079 | <p id="rfc.section.6.1.p.1">An origin server could create a Set-Cookie2 header to track the path of a user through the server. Users may object to this |
|---|
| 1080 | behavior as an intrusive accumulation of information, even if their identity is not evident. (Identity might become evident, |
|---|
| 1081 | for example, if a user subsequently fills out a form that contains identifying information.) This state management specification |
|---|
| 1082 | therefore requires that a user agent give the user control over such a possible intrusion, although the interface through |
|---|
| 1083 | which the user is given this control is left unspecified. However, the control mechanisms provided <em class="bcp14">SHALL</em> at least allow the user |
|---|
| 1084 | </p> |
|---|
| 1085 | <ul> |
|---|
| 1086 | <li>to completely disable the sending and saving of cookies.</li> |
|---|
| 1087 | <li>to determine whether a stateful session is in progress.</li> |
|---|
| 1088 | <li>to control the saving of a cookie on the basis of the cookie's Domain attribute.</li> |
|---|
| 1089 | </ul> |
|---|
| 1090 | <p id="rfc.section.6.1.p.2">Such control could be provided, for example, by mechanisms </p> |
|---|
| 1091 | <ul> |
|---|
| 1092 | <li>to notify the user when the user agent is about to send a cookie to the origin server, to offer the option not to begin a |
|---|
| 1093 | session. |
|---|
| 1094 | </li> |
|---|
| 1095 | <li>to display a visual indication that a stateful session is in progress.</li> |
|---|
| 1096 | <li>to let the user decide which cookies, if any, should be saved when the user concludes a window or user agent session.</li> |
|---|
| 1097 | <li>to let the user examine and delete the contents of a cookie at any time.</li> |
|---|
| 1098 | </ul> |
|---|
| 1099 | <p id="rfc.section.6.1.p.3">A user agent usually begins execution with no remembered state information. It <em class="bcp14">SHOULD</em> be possible to configure a user agent never to send Cookie headers, in which case it can never sustain state with an origin |
|---|
| 1100 | server. (The user agent would then behave like one that is unaware of how to handle Set-Cookie2 response headers.) |
|---|
| 1101 | </p> |
|---|
| 1102 | <p id="rfc.section.6.1.p.4">When the user agent terminates execution, it <em class="bcp14">SHOULD</em> let the user discard all state information. Alternatively, the user agent <em class="bcp14">MAY</em> ask the user whether state information should be retained; the default should be "no". If the user chooses to retain state |
|---|
| 1103 | information, it would be restored the next time the user agent runs. |
|---|
| 1104 | </p> |
|---|
| 1105 | <p id="rfc.section.6.1.p.5">NOTE: User agents should probably be cautious about using files to store cookies long-term. If a user runs more than one instance |
|---|
| 1106 | of the user agent, the cookies could be commingled or otherwise corrupted. |
|---|
| 1107 | </p> |
|---|
| 1108 | <h2 id="rfc.section.6.2"><a href="#rfc.section.6.2">6.2</a> Origin Server Role |
|---|
| 1109 | </h2> |
|---|
| 1110 | <p id="rfc.section.6.2.p.1">An origin server <em class="bcp14">SHOULD</em> promote informed consent by adding CommentURL or Comment information to the cookies it sends. CommentURL is preferred because |
|---|
| 1111 | of the opportunity to provide richer information in a multiplicity of languages. |
|---|
| 1112 | </p> |
|---|
| 1113 | <h2 id="rfc.section.6.3"><a href="#rfc.section.6.3">6.3</a> Clear Text |
|---|
| 1114 | </h2> |
|---|
| 1115 | <p id="rfc.section.6.3.p.1">The information in the Set-Cookie2 and Cookie headers is unprotected. As a consequence: </p> |
|---|
| 1116 | <ol> |
|---|
| 1117 | <li>Any sensitive information that is conveyed in them is exposed to intruders.</li> |
|---|
| 1118 | <li>A malicious intermediary could alter the headers as they travel in either direction, with unpredictable results.</li> |
|---|
| 1119 | </ol> |
|---|
| 1120 | <p id="rfc.section.6.3.p.2">These facts imply that information of a personal and/or financial nature should only be sent over a secure channel. For less |
|---|
| 1121 | sensitive information, or when the content of the header is a database key, an origin server should be vigilant to prevent |
|---|
| 1122 | a bad Cookie value from causing failures. |
|---|
| 1123 | </p> |
|---|
| 1124 | <p id="rfc.section.6.3.p.3">A user agent in a shared user environment poses a further risk. Using a cookie inspection interface, User B could examine |
|---|
| 1125 | the contents of cookies that were saved when User A used the machine. |
|---|
| 1126 | </p> |
|---|
| 1127 | <h1 id="rfc.section.7"><a href="#rfc.section.7">7.</a> <a id="IANA.considerations" href="#IANA.considerations">IANA Considerations</a></h1> |
|---|
| 1128 | <p id="rfc.section.7.p.1">TBD.</p> |
|---|
| 1129 | <h1 id="rfc.section.8"><a href="#rfc.section.8">8.</a> SECURITY CONSIDERATIONS |
|---|
| 1130 | </h1> |
|---|
| 1131 | <h2 id="rfc.section.8.1"><a href="#rfc.section.8.1">8.1</a> Protocol Design |
|---|
| 1132 | </h2> |
|---|
| 1133 | <p id="rfc.section.8.1.p.1">The restrictions on the value of the Domain attribute, and the rules concerning unverifiable transactions, are meant to reduce |
|---|
| 1134 | the ways that cookies can "leak" to the "wrong" site. The intent is to restrict cookies to one host, or a closely related |
|---|
| 1135 | set of hosts. Therefore a request-host is limited as to what values it can set for Domain. We consider it acceptable for hosts |
|---|
| 1136 | host1.foo.com and host2.foo.com to share cookies, but not a.com and b.com. |
|---|
| 1137 | </p> |
|---|
| 1138 | <p id="rfc.section.8.1.p.2">Similarly, a server can set a Path only for cookies that are related to the request-URI.</p> |
|---|
| 1139 | <h2 id="rfc.section.8.2"><a href="#rfc.section.8.2">8.2</a> Cookie Spoofing |
|---|
| 1140 | </h2> |
|---|
| 1141 | <p id="rfc.section.8.2.p.1">Proper application design can avoid spoofing attacks from related domains. Consider: </p> |
|---|
| 1142 | <ol> |
|---|
| 1143 | <li>User agent makes request to victim.cracker.edu, gets back cookie session_id="1234" and sets the default domain victim.cracker.edu.</li> |
|---|
| 1144 | <li>User agent makes request to spoof.cracker.edu, gets back cookie session-id="1111", with Domain=".cracker.edu".</li> |
|---|
| 1145 | <li>User agent makes request to victim.cracker.edu again, and passes |
|---|
| 1146 | <div id="rfc.figure.u.25"></div><pre class="text"> Cookie: $Version="1"; session_id="1234", |
|---|
| 1147 | $Version="1"; session_id="1111"; $Domain=".cracker.edu" |
|---|
| 1148 | </pre> The server at victim.cracker.edu should detect that the second cookie was not one it originated by noticing that the Domain |
|---|
| 1149 | attribute is not for itself and ignore it.</li> |
|---|
| 1150 | </ol> |
|---|
| 1151 | <h2 id="rfc.section.8.3"><a href="#rfc.section.8.3">8.3</a> Unexpected Cookie Sharing |
|---|
| 1152 | </h2> |
|---|
| 1153 | <p id="rfc.section.8.3.p.1">A user agent <em class="bcp14">SHOULD</em> make every attempt to prevent the sharing of session information between hosts that are in different domains. Embedded or |
|---|
| 1154 | inlined objects may cause particularly severe privacy problems if they can be used to share cookies between disparate hosts. |
|---|
| 1155 | For example, a malicious server could embed cookie information for host a.com in a URI for a CGI on host b.com. User agent |
|---|
| 1156 | implementors are strongly encouraged to prevent this sort of exchange whenever possible. |
|---|
| 1157 | </p> |
|---|
| 1158 | <h2 id="rfc.section.8.4"><a href="#rfc.section.8.4">8.4</a> Cookies For Account Information |
|---|
| 1159 | </h2> |
|---|
| 1160 | <p id="rfc.section.8.4.p.1">While it is common practice to use them this way, cookies are not designed or intended to be used to hold authentication information, |
|---|
| 1161 | such as account names and passwords. Unless such cookies are exchanged over an encrypted path, the account information they |
|---|
| 1162 | contain is highly vulnerable to perusal and theft. |
|---|
| 1163 | </p> |
|---|
| 1164 | <h1 id="rfc.section.9"><a href="#rfc.section.9">9.</a> OTHER, SIMILAR, PROPOSALS |
|---|
| 1165 | </h1> |
|---|
| 1166 | <p id="rfc.section.9.p.1">Apart from RFC 2109, three other proposals have been made to accomplish similar goals. This specification began as an amalgam |
|---|
| 1167 | of Kristol's State-Info proposal <a href="#DMK95" id="rfc.xref.DMK95.1"><cite title="Proposed HTTP State-Info Mechanism">[DMK95]</cite></a> and Netscape's Cookie proposal <a href="#Netscape" id="rfc.xref.Netscape.2"><cite title="Persistent Client State -- HTTP Cookies">[Netscape]</cite></a>. |
|---|
| 1168 | </p> |
|---|
| 1169 | <p id="rfc.section.9.p.2">Brian Behlendorf proposed a Session-ID header that would be user-agent-initiated and could be used by an origin server to |
|---|
| 1170 | track "clicktrails". It would not carry any origin-server-defined state, however. Phillip Hallam-Baker has proposed another |
|---|
| 1171 | client-defined session ID mechanism for similar purposes. |
|---|
| 1172 | </p> |
|---|
| 1173 | <p id="rfc.section.9.p.3">While both session IDs and cookies can provide a way to sustain stateful sessions, their intended purpose is different, and, |
|---|
| 1174 | consequently, the privacy requirements for them are different. A user initiates session IDs to allow servers to track progress |
|---|
| 1175 | through them, or to distinguish multiple users on a shared machine. Cookies are server-initiated, so the cookie mechanism |
|---|
| 1176 | described here gives users control over something that would otherwise take place without the users' awareness. Furthermore, |
|---|
| 1177 | cookies convey rich, server-selected information, whereas session IDs comprise user-selected, simple information. |
|---|
| 1178 | </p> |
|---|
| 1179 | <h1 id="rfc.section.10"><a href="#rfc.section.10">10.</a> HISTORICAL |
|---|
| 1180 | </h1> |
|---|
| 1181 | <h2 id="rfc.section.10.1"><a href="#rfc.section.10.1">10.1</a> Compatibility with Existing Implementations |
|---|
| 1182 | </h2> |
|---|
| 1183 | <p id="rfc.section.10.1.p.1">Existing cookie implementations, based on the Netscape specification, use the Set-Cookie (not Set-Cookie2) header. User agents |
|---|
| 1184 | that receive in the same response both a Set-Cookie and Set-Cookie2 response header for the same cookie <em class="bcp14">MUST</em> discard the Set-Cookie information and use only the Set-Cookie2 information. Furthermore, a user agent <em class="bcp14">MUST</em> assume, if it received a Set-Cookie2 response header, that the sending server complies with this document and will understand |
|---|
| 1185 | Cookie request headers that also follow this specification. |
|---|
| 1186 | </p> |
|---|
| 1187 | <p id="rfc.section.10.1.p.2">New cookies <em class="bcp14">MUST</em> replace both equivalent old- and new-style cookies. That is, if a user agent that follows both this specification and Netscape's |
|---|
| 1188 | original specification receives a Set-Cookie2 response header, and the NAME and the Domain and Path attributes match (per |
|---|
| 1189 | the Cookie Management section) a Netscape-style cookie, the Netscape-style cookie <em class="bcp14">MUST</em> be discarded, and the user agent <em class="bcp14">MUST</em> retain only the cookie adhering to this specification. |
|---|
| 1190 | </p> |
|---|
| 1191 | <p id="rfc.section.10.1.p.3">Older user agents that do not understand this specification, but that do understand Netscape's original specification, will |
|---|
| 1192 | not recognize the Set-Cookie2 response header and will receive and send cookies according to the older specification. |
|---|
| 1193 | </p> |
|---|
| 1194 | <p id="rfc.section.10.1.p.4">A user agent that supports both this specification and Netscape-style cookies <em class="bcp14">SHOULD</em> send a Cookie request header that follows the older Netscape specification if it received the cookie in a Set-Cookie response |
|---|
| 1195 | header and not in a Set-Cookie2 response header. However, it <em class="bcp14">SHOULD</em> send the following request header as well: |
|---|
| 1196 | </p> |
|---|
| 1197 | <div id="rfc.figure.u.26"></div><pre class="text"> Cookie2: $Version="1" |
|---|
| 1198 | </pre><p id="rfc.section.10.1.p.6">The Cookie2 header advises the server that the user agent understands new-style cookies. If the server understands new-style |
|---|
| 1199 | cookies, as well, it <em class="bcp14">SHOULD</em> continue the stateful session by sending a Set-Cookie2 response header, rather than Set-Cookie. A server that does not understand |
|---|
| 1200 | new-style cookies will simply ignore the Cookie2 request header. |
|---|
| 1201 | </p> |
|---|
| 1202 | <h2 id="rfc.section.10.2"><a href="#rfc.section.10.2">10.2</a> Caching and HTTP/1.0 |
|---|
| 1203 | </h2> |
|---|
| 1204 | <p id="rfc.section.10.2.p.1">Some caches, such as those conforming to HTTP/1.0, will inevitably cache the Set-Cookie2 and Set-Cookie headers, because there |
|---|
| 1205 | was no mechanism to suppress caching of headers prior to HTTP/1.1. This caching can lead to security problems. Documents transmitted |
|---|
| 1206 | by an origin server along with Set-Cookie2 and Set-Cookie headers usually either will be uncachable, or will be "pre-expired". |
|---|
| 1207 | As long as caches obey instructions not to cache documents (following Expires: <a date in the past> or Pragma: no-cache (HTTP/1.0), |
|---|
| 1208 | or Cache-control: no-cache (HTTP/1.1)) uncachable documents present no problem. However, pre-expired documents may be stored |
|---|
| 1209 | in caches. They require validation (a conditional GET) on each new request, but some cache operators loosen the rules for |
|---|
| 1210 | their caches, and sometimes serve expired documents without first validating them. This combination of factors can lead to |
|---|
| 1211 | cookies meant for one user later being sent to another user. The Set-Cookie2 and Set-Cookie headers are stored in the cache, |
|---|
| 1212 | and, although the document is stale (expired), the cache returns the document in response to later requests, including cached |
|---|
| 1213 | headers. |
|---|
| 1214 | </p> |
|---|
| 1215 | <h1 id="rfc.section.11"><a href="#rfc.section.11">11.</a> ACKNOWLEDGEMENTS |
|---|
| 1216 | </h1> |
|---|
| 1217 | <p id="rfc.section.11.p.1">This document really represents the collective efforts of the HTTP Working Group of the IETF and, particularly, the following |
|---|
| 1218 | people, in addition to the authors: Roy Fielding, Yaron Goland, Marc Hedlund, Ted Hardie, Koen Holtman, Shel Kaphan, Rohit |
|---|
| 1219 | Khare, Foteos Macrides, David W. Morris. |
|---|
| 1220 | </p> |
|---|
| 1221 | <h1 id="rfc.references"><a href="#rfc.section.12" id="rfc.section.12">12.</a> References |
|---|
| 1222 | </h1> |
|---|
| 1223 | <table summary="References"> |
|---|
| 1224 | <tr> |
|---|
| 1225 | <td class="reference"><b id="DMK95">[DMK95]</b></td> |
|---|
| 1226 | <td class="top">Kristol, D. M., “<a href="http://portal.research.bell-labs.com/~dmk/state-info.html">Proposed HTTP State-Info Mechanism</a>”, September 1995, <<a href="http://portal.research.bell-labs.com/~dmk/state-info.html">http://portal.research.bell-labs.com/~dmk/state-info.html</a>>.<br>available at <http://portal.research.bell-labs.com/~dmk/state-info.html> |
|---|
| 1227 | </td> |
|---|
| 1228 | </tr> |
|---|
| 1229 | <tr> |
|---|
| 1230 | <td class="reference"><b id="Netscape">[Netscape]</b></td> |
|---|
| 1231 | <td class="top">“<a href="http://www.netscape.com/newsref/std/cookie_spec.html">Persistent Client State -- HTTP Cookies</a>”, <<a href="http://www.netscape.com/newsref/std/cookie_spec.html">http://www.netscape.com/newsref/std/cookie_spec.html</a>>.<br>available at <http://www.netscape.com/newsref/std/cookie_spec.html> |
|---|
| 1232 | </td> |
|---|
| 1233 | </tr> |
|---|
| 1234 | <tr> |
|---|
| 1235 | <td class="reference"><b id="RFC2109">[RFC2109]</b></td> |
|---|
| 1236 | <td class="top"><a title="Bell Laboratories, Lucent Technologies">Kristol, D.M.</a> and <a title="Netscape Communications Corp.">L. Montulli</a>, “<a href="http://tools.ietf.org/html/rfc2109">HTTP State Management Mechanism</a>”, RFC 2109, February 1997. |
|---|
| 1237 | </td> |
|---|
| 1238 | </tr> |
|---|
| 1239 | <tr> |
|---|
| 1240 | <td class="reference"><b id="RFC2119">[RFC2119]</b></td> |
|---|
| 1241 | <td class="top"><a title="Harvard University">Bradner, S.</a>, “<a href="http://tools.ietf.org/html/rfc2119">Key words for use in RFCs to Indicate Requirement Levels</a>”, BCP 14, RFC 2119, March 1997. |
|---|
| 1242 | </td> |
|---|
| 1243 | </tr> |
|---|
| 1244 | <tr> |
|---|
| 1245 | <td class="reference"><b id="RFC2279">[RFC2279]</b></td> |
|---|
| 1246 | <td class="top"><a title="Alis Technologies">Yergeau, F.</a>, “<a href="http://tools.ietf.org/html/rfc2279">UTF-8, a transformation format of ISO 10646</a>”, RFC 2279, January 1998. |
|---|
| 1247 | </td> |
|---|
| 1248 | </tr> |
|---|
| 1249 | <tr> |
|---|
| 1250 | <td class="reference"><b id="RFC2396">[RFC2396]</b></td> |
|---|
| 1251 | <td class="top"><a title="World Wide Web Consortium">Berners-Lee, T.</a>, <a title="Department of Information and Computer Science">Fielding, R.T.</a>, and <a title="Xerox PARC">L. Masinter</a>, “<a href="http://tools.ietf.org/html/rfc2396">Uniform Resource Identifiers (URI): Generic Syntax</a>”, RFC 2396, August 1998. |
|---|
| 1252 | </td> |
|---|
| 1253 | </tr> |
|---|
| 1254 | <tr> |
|---|
| 1255 | <td class="reference"><b id="RFC2616">[RFC2616]</b></td> |
|---|
| 1256 | <td class="top"><a title="University of California, Irvine">Fielding, R.</a>, <a title="W3C">Gettys, J.</a>, <a title="Compaq Computer Corporation">Mogul, J.</a>, <a title="MIT Laboratory for Computer Science">Frystyk, H.</a>, <a title="Xerox Corporation">Masinter, L.</a>, <a title="Microsoft Corporation">Leach, P.</a>, and <a title="W3C">T. Berners-Lee</a>, “<a href="http://tools.ietf.org/html/rfc2616">Hypertext Transfer Protocol -- HTTP/1.1</a>”, RFC 2616, June 1999. |
|---|
| 1257 | </td> |
|---|
| 1258 | </tr> |
|---|
| 1259 | </table> |
|---|
| 1260 | <h1 id="rfc.authors"><a href="#rfc.authors">Authors' Addresses</a></h1> |
|---|
| 1261 | <address class="vcard"><span class="vcardline"><span class="fn">David M. Kristol</span><span class="n hidden"><span class="family-name">Kristol</span><span class="given-name">David M.</span></span></span><span class="org vcardline">Bell Laboratories, Lucent Technologies</span><span class="adr"><span class="street-address vcardline">600 Mountain Ave. Room 2A-333</span><span class="vcardline"><span class="locality">Murray Hill</span>, <span class="region">NJ</span> <span class="postal-code">07974</span></span></span><span class="vcardline tel">Phone: <a href="tel:(908)582-2250"><span class="value">(908) 582-2250</span></a></span><span class="vcardline tel"><span class="type">Fax</span>: <a href="fax:(908)582-1239"><span class="value">(908) 582-1239</span></a></span><span class="vcardline">EMail: <a><span class="email">dmk@bell-labs.com</span></a></span></address> |
|---|
| 1262 | <address class="vcard"><span class="vcardline"><span class="fn">Lou Montulli</span><span class="n hidden"><span class="family-name">Montulli</span><span class="given-name">Lou</span></span></span><span class="org vcardline">Epinions.com, Inc.</span><span class="adr"><span class="street-address vcardline">2037 Landings Dr.</span><span class="vcardline"><span class="locality">Mountain View</span>, <span class="region">CA</span> <span class="postal-code">94301</span></span></span><span class="vcardline">EMail: <a><span class="email">lou@montulli.org</span></a></span></address> |
|---|
| 1263 | <h1><a id="rfc.copyright" href="#rfc.copyright">Full Copyright Statement</a></h1> |
|---|
| 1264 | <p>Copyright © The Internet Society (2000).</p> |
|---|
| 1265 | <p>This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the |
|---|
| 1266 | authors retain all their rights. |
|---|
| 1267 | </p> |
|---|
| 1268 | <p>This document and the information contained herein are provided on an “AS IS” basis and THE CONTRIBUTOR, THE ORGANIZATION |
|---|
| 1269 | HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, |
|---|
| 1270 | EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY |
|---|
| 1271 | RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. |
|---|
| 1272 | </p> |
|---|
| 1273 | <h1><a id="rfc.ipr" href="#rfc.ipr">Intellectual Property</a></h1> |
|---|
| 1274 | <p>The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might |
|---|
| 1275 | be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any |
|---|
| 1276 | license under such rights might or might not be available; nor does it represent that it has made any independent effort to |
|---|
| 1277 | identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and |
|---|
| 1278 | BCP 79. |
|---|
| 1279 | </p> |
|---|
| 1280 | <p>Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result |
|---|
| 1281 | of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users |
|---|
| 1282 | of this specification can be obtained from the IETF on-line IPR repository at <<a href="http://www.ietf.org/ipr">http://www.ietf.org/ipr</a>>. |
|---|
| 1283 | </p> |
|---|
| 1284 | <p>The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary |
|---|
| 1285 | rights that may cover technology that may be required to implement this standard. Please address the information to the IETF |
|---|
| 1286 | at <a href="mailto:ietf-ipr@ietf.org">ietf-ipr@ietf.org</a>. |
|---|
| 1287 | </p> |
|---|
| 1288 | <h1>Acknowledgement</h1> |
|---|
| 1289 | <p>Funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA).</p> |
|---|
| 1290 | <h1 id="rfc.index"><a href="#rfc.index">Index</a></h1> |
|---|
| 1291 | <p class="noprint"><a href="#rfc.index.C">C</a> <a href="#rfc.index.D">D</a> <a href="#rfc.index.H">H</a> <a href="#rfc.index.N">N</a> <a href="#rfc.index.R">R</a> <a href="#rfc.index.S">S</a> |
|---|
| 1292 | </p> |
|---|
| 1293 | <div class="print2col"> |
|---|
| 1294 | <ul class="ind"> |
|---|
| 1295 | <li class="indline0"><a id="rfc.index.C" href="#rfc.index.C"><b>C</b></a><ul class="ind"> |
|---|
| 1296 | <li class="indline1">Cookie header <a class="iref" href="#rfc.iref.c.1"><b>3.3.4</b></a></li> |
|---|
| 1297 | <li class="indline1">Cookie2 header <a class="iref" href="#rfc.iref.c.2"><b>3.3.5</b></a></li> |
|---|
| 1298 | </ul> |
|---|
| 1299 | </li> |
|---|
| 1300 | <li class="indline0"><a id="rfc.index.D" href="#rfc.index.D"><b>D</b></a><ul class="ind"> |
|---|
| 1301 | <li class="indline1"><em>DMK95</em> <a class="iref" href="#rfc.xref.DMK95.1">9</a>, <a class="iref" href="#DMK95"><b>12</b></a></li> |
|---|
| 1302 | </ul> |
|---|
| 1303 | </li> |
|---|
| 1304 | <li class="indline0"><a id="rfc.index.H" href="#rfc.index.H"><b>H</b></a><ul class="ind"> |
|---|
| 1305 | <li class="indline1">Headers |
|---|
| 1306 | <ul class="ind"> |
|---|
| 1307 | <li class="indline1">Cookie <a class="iref" href="#rfc.iref.h.2"><b>3.3.4</b></a></li> |
|---|
| 1308 | <li class="indline1">Cookie2 <a class="iref" href="#rfc.iref.h.3"><b>3.3.5</b></a></li> |
|---|
| 1309 | <li class="indline1">Set-Cookie2 <a class="iref" href="#rfc.iref.h.1"><b>3.2.2</b></a></li> |
|---|
| 1310 | </ul> |
|---|
| 1311 | </li> |
|---|
| 1312 | </ul> |
|---|
| 1313 | </li> |
|---|
| 1314 | <li class="indline0"><a id="rfc.index.N" href="#rfc.index.N"><b>N</b></a><ul class="ind"> |
|---|
| 1315 | <li class="indline1"><em>Netscape</em> <a class="iref" href="#rfc.xref.Netscape.1">§</a>, <a class="iref" href="#rfc.xref.Netscape.2">9</a>, <a class="iref" href="#Netscape"><b>12</b></a></li> |
|---|
| 1316 | </ul> |
|---|
| 1317 | </li> |
|---|
| 1318 | <li class="indline0"><a id="rfc.index.R" href="#rfc.index.R"><b>R</b></a><ul class="ind"> |
|---|
| 1319 | <li class="indline1"><em>RFC2109</em> <a class="iref" href="#RFC2109"><b>12</b></a></li> |
|---|
| 1320 | <li class="indline1"><em>RFC2119</em> <a class="iref" href="#rfc.xref.RFC2119.1">1.1</a>, <a class="iref" href="#RFC2119"><b>12</b></a></li> |
|---|
| 1321 | <li class="indline1"><em>RFC2279</em> <a class="iref" href="#rfc.xref.RFC2279.1">3.2.2</a>, <a class="iref" href="#RFC2279"><b>12</b></a></li> |
|---|
| 1322 | <li class="indline1"><em>RFC2396</em> <a class="iref" href="#rfc.xref.RFC2396.1">1</a>, <a class="iref" href="#RFC2396"><b>12</b></a></li> |
|---|
| 1323 | <li class="indline1"><em>RFC2616</em> <a class="iref" href="#rfc.xref.RFC2616.1">1</a>, <a class="iref" href="#rfc.xref.RFC2616.2">3.1</a>, <a class="iref" href="#rfc.xref.RFC2616.3">3.2.2</a>, <a class="iref" href="#RFC2616"><b>12</b></a></li> |
|---|
| 1324 | </ul> |
|---|
| 1325 | </li> |
|---|
| 1326 | <li class="indline0"><a id="rfc.index.S" href="#rfc.index.S"><b>S</b></a><ul class="ind"> |
|---|
| 1327 | <li class="indline1">Set-Cookie2 header <a class="iref" href="#rfc.iref.s.1"><b>3.2.2</b></a></li> |
|---|
| 1328 | </ul> |
|---|
| 1329 | </li> |
|---|
| 1330 | </ul> |
|---|
| 1331 | </div> |
|---|
| 1332 | </body> |
|---|
| 1333 | </html> |
|---|
![(please configure the [header_logo] section in trac.ini)](https://www.ietf.org/images/ietflogotrans.gif)
