#32860 [Opn]: quoted-string cookies not handled correctly

ID: 32860 Updated by: sesser@php.net Reported By: ast at gmx dot ch Status: Open Bug Type: Feature/Change Request Operating System: * PHP Version: 4.3.11 New Comment: You are wrong. It is not a bug. PHP implements Cookie version 0 which is based upon the Netscape Cookie standard. Both RFCs 2109/2965 speak of Cookie version 1. Previous Comments: ------------------------------------------------------------------------ [2005-04-28 12:03:44] ast at gmx dot ch But even the initial cookie RFC, http://rfc.net/rfc2109.html, described that a value may be either a TOKEN or a quoted-string. The only difference to the new cookie RFC, RFC 2965, is that <"> are not allowed in quoted-string values of the old version while they may be in quoted-string values, just escaped by the escape character "\" in the new version. Therefore, the separaters "," and ";" are allowed in quoted-string values even in the old cookie RFC. Maybe you could list it as a low-priority bug, but it's a bug and not a feature or a change request. ------------------------------------------------------------------------ [2005-04-28 08:16:09] derick@php.net When PHP was written, this RFC did not yet exist - that's why we classify it as a feature request - it's basically "cookie version 1.1". ------------------------------------------------------------------------ [2005-04-28 00:04:15] ast at gmx dot ch Feature/Change request? I don't agree. Handling a HTTP header not according to the RFCs they are defined in doesn't make sense at all. Therefore, it's a bug. But it's not that important to me. Do what you consider the right thing. ------------------------------------------------------------------------ [2005-04-28 00:00:18] sniper@php.net Reclassified. ------------------------------------------------------------------------ [2005-04-27 23:20:34] ast at gmx dot ch Obviously, the bug report was mangled. Here's a pretty print of the report / fix: http://nei.ch/articles/quoted_string_cookie_fix.php ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/32860 -- Edit this bug report at http://bugs.php.net/?id=32860&edit=1