W3C home > Mailing lists > Public > ietf-http-wg@w3.org > April to June 2022

Signing Set-Cookie

From: Justin Richer <jricher@mit.edu>
Date: Wed, 1 Jun 2022 17:36:35 -0400
Message-Id: <A0601849-2870-4150-9926-5FA706D7F6DE@mit.edu>
To: HTTP Working Group <ietf-http-wg@w3.org>
The Set-Cookie header syntax is weird in that it doesn’t allow for concatenation in the normal List syntax. The Signature spec relies on this concatenation for the combination of values of headers that show up multiple times. This discrepancy is called out in this issue:

https://github.com/httpwg/http-extensions/issues/1183 <https://github.com/httpwg/http-extensions/issues/1183>

However, on further investigation, I don’t think this actually causes a problem. The concatenation process outlined in Signatures still works on multiple Set-Cookie values, the only weird thing is that the RESULT of that process cannot itself be parsed as a valid Set-Cookie header. 

But the thing is, it doesn’t have to be parsed. It just has to exist as a string in the signature base, and be re-created by both signer and verifier in a consistent way. 

I’m planning on closing this issue with a note in the appropriate section of the signature spec, but if there’s something I’m missing about this, please chime in.

 — Justin
Received on Wednesday, 1 June 2022 21:36:49 UTC

This archive was generated by hypermail 2.4.0 : Wednesday, 1 June 2022 21:36:50 UTC