Comments (4)
I will need real proof that the dashes are the reason for the issue and not something else, especially since you are not referencing any actual standards and simply the cURL site. The standards come in the form of RFC 6265.
https://tools.ietf.org/html/rfc6265#section-4.1.1
expires-av = "Expires=" sane-cookie-date
sane-cookie-date = <rfc1123-date, defined in [RFC2616], Section 3.3.1>
https://tools.ietf.org/html/rfc2616#section-3.3.1
HTTP applications have historically allowed three different formats
for the representation of date/time stamps:Sun, 06 Nov 1994 08:49:37 GMT ; RFC 822, updated by RFC 1123 Sunday, 06-Nov-94 08:49:37 GMT ; RFC 850, obsoleted by RFC 1036 Sun Nov 6 08:49:37 1994 ; ANSI C's asctime() format
The first format is preferred as an Internet standard and represents a fixed-length subset of that defined by RFC 1123 [8](an update to RFC 822 [9]). The second format is in common use, but is based on the obsolete RFC 850 [12] date format and lacks a four-digit year.
You can see the standard supports our format, and even looks the format "Wed, 06-Jul-16 02:19:47 GMT" is invalid, because you need to have the full weekday name, not the abbreviation.
The expires on this module has been working fine in all browsers I have tested for years and years, so I am not inclined to change it, especially when the standards explicitly state that the format we are using is valid and even preferred.
The RFC goes on further to say the following:
HTTP/1.1 clients and servers that parse the date value MUST accept all three formats (for compatibility with HTTP/1.0), though they MUST only generate the RFC 1123 format for representing HTTP-date values in header fields. See section 19.3 for further information.
The wording "MUST only generate the RFC 1123 format" is what we do: that is the format without the dashes.
from cookies.
Yeah, I understand.
I just presented the exact chain of events because that's really all I have to go on. To be clear, I don't actually expect you to change anything. There isn't enough information here and you are compliant with the RFCs.
See, the majority of users on my site do not have issues with my far-future expires
login cookie. One user last night did have trouble from their laptop on FF38 on Linux (far from an exotic combination).
After receiving this response...
Set-Cookie: __cfduid=xxx; expires=Wed, 06-Jul-16 02:19:47 GMT; path=/; domain=.example.com; HttpOnly
Set-Cookie: sessionId=xxx-xxx-xxx; path=/; expires=Wed, 06 Jul 2016 02:19:47 GMT; httponly
...their browser had a far-future expiring __cfduid
cookie yet only an ephemeral sessionId
cookie which baffled me. Especially when "throwing in some dashes" really did fix the issue for them.
Yet, speaking with that user some more today, their browser does correctly parse the expiration of this wikipedia cookie which has the same expires format as my cookie above:
Set-Cookie: WMF-Last-Access=07-Jul-2015;Path=/;HttpOnly;Expires=Sat, 08 Aug 2015 12:00:00 GMT
I will close this issue shortly since I've got nothing, but do you have any advice for a kind of gauntlet I can throw at this user that might illuminate an issue if there is one?
from cookies.
I have the same issue in an unrelated project and I found that the RFC2109 specifies that date in the Expires header must be dash separated. See: https://www.ietf.org/rfc/rfc2109.txt
And it turns out some older Browsers have implemented cookies this way.
from cookies.
Hi @Zeikko RFC 2109 is irrelevant. You can see that the RFC we follow here that I mentioned above, RFC 6265, obsoletes (i.e. replaces) RFC 2965. And RFC 2965 obsoletes (i.e. replaces) the RFC 2109 you are referencing. We can only follow one RFC and we follow the current one: RFC 6265.
from cookies.
Related Issues (20)
- Getting cookies of a request without having to pass response argument HOT 2
- Set Domain in options is not working HOT 3
- request.connection is deprecated
- set cookie with ";" is broken and the "signed" property returns undefined HOT 2
- Release sameSite = none PR HOT 3
- Storing cookie value + signature in a unified cookie instead of cookie_name.sig HOT 1
- Using this with Http2stream HOT 3
- How to install? HOT 1
- Migrate to travis-ci.com HOT 1
- Support of Sha256 HOT 1
- TypeError: Cannot read property 'encrypted' of undefined HOT 1
- make setHeader compatible with fastify reply (patch included) HOT 2
- Cookie maxAge HOT 1
- Using "signed: ture" will set two cookies? HOT 3
- missing cookie option "Priority" HOT 1
- How to allow multiple domains for CookieOptions.domain
- Get a cookie in 2023 HOT 1
- How to set SameSite attribute for .sig? HOT 1
- Cookies Having Independent Partitioned State (CHIPS, also know as Partitioned cookies) HOT 2
- Cookie overwrite not working
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cookies.