Re: LAST CALL, "HTTP State Management Mechanism (Rev1) " to Propo

Dave Kristol:
>
[...]
>Does this wording express it adequately?:
>
>If the user agent allows the user to follow the [CommentURL] link [as
>part of a cookie inspection user interface], it should neither send nor
>accept a cookie until the user has completed the inspection.

I think the approach to solving this problem is wrong: the burden of
ensuring that the commentURL mechanism does not lead to
user-unfriendly or recursive situations should be on the server side.

I propose something like this:

 Servers SHOULD ensure that the user can visit the information pointed
 to by the commentURL without causing the user agent to receive
 additional Set-Cookie2 headers.  User agents SHOULD guard against the
 entering of infinite loops due to the commentURL mechanism, and MAY do
 this by disabling cookie processing when the commentURL is visited.

>Dave Kristol

Koen.