Req #23955 [Opn->Csd]: setcookie(): max-age needed [to comply with rfc]

From: Date: Sun, 06 Jan 2013 02:24:34 +0000
Subject: Req #23955 [Opn->Csd]: setcookie(): max-age needed [to comply with rfc]
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-175773@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=23955&edit=1

 ID:                 23955
 Updated by:         lstrojny@php.net
 Reported by:        kruemelmonster at cookiecan dot de
 Summary:            setcookie(): max-age needed [to comply with rfc]
-Status:             Open
+Status:             Closed
 Type:               Feature/Change Request
 Package:            *General Issues
 PHP Version:        4.3.2
-Assigned To:        
+Assigned To:        lstrojny
 Block user comment: N
 Private report:     N

 New Comment:

The fix for this bug has been committed.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.

Merged in 5.5 and master.


Previous Comments:
------------------------------------------------------------------------
[2012-10-25 09:35:48] jpauli@php.net

The timezone is not an issue as dates are GMT based anyway.
However, the issue shows up when the client UA has a wrong local time set.

------------------------------------------------------------------------
[2003-06-02 07:51:37] kruemelmonster at cookiecan dot de


based on the discussion in #23835, I file here that the function setcookie() should include the
missing paramenter 'max-age'.

max-age is defined in:
http://www.ietf.org/rfc/rfc2109.txt
http://www.ietf.org/rfc/rfc2965.txt 
which both are referenced in the documentation of the setcookie() - func itself.

max-age has become more and more important, because it removes the timezone-issue from the former
way of timestamping cookie expiration dates.


thanks for considering. 

-----

here's some detail taken from the rfc-specs:


Max-Age=value

  OPTIONAL.  The value of the Max-Age attribute is delta-seconds, the lifetime of the cookie in
seconds, a decimal non-negative integer.  To handle cached cookies correctly, a client SHOULD
calculate the age of the cookie according to the age calculation rules in the HTTP/1.1 specification
[RFC2616].  When the age is greater than delta-seconds seconds, the client SHOULD discard the      
cookie.  A value of zero means the cookie SHOULD be discarded immediately.




------------------------------------------------------------------------



-- 
Edit this bug report at https://bugs.php.net/bug.php?id=23955&edit=1

Thread (3 messages)

« previous php.bugs (#175773) next »