Re: Handling Cookies is a Minefield

On Tue, Dec 3, 2024 at 9:37 AM David Benjamin <davidben@chromium.org> wrote:

>
> Regardless, I think which spec is where is mostly a distraction. When
> something is ill-defined, fixing the ill-definedness necessarily involves a
> feedback loop between spec and implementation, with changes on both sides,
> until we figure out where to converge. Different communities manage that
> feedback loop differently. The mishmash of specs you see is a symptom of
> all this work not being done.
>
> If we had infinite energy, could resolve problems at infinite speed, and
> had infinite bandwidth for coordination, the compatibility needs of the
> HTTP ecosystem (web and non-web) would be perfectly uniform, the IETF
> general-HTTP-level specifications would perfectly match those needs, and
> the web stuff could cleanly layer on top of it, without having to override
> any of it. We do not live in that world, so here we are. But I think
> focusing on the symptom of our limitations doesn't help us move forward.
> How to move forward is to do the work to converge things.
>

This! 100% this! The problem is not a lack of clear specification here
(though the spec could certainly be improved). The problem is that the
ecosystem as it currently exists relies on load-bearing, spec-non-compliant
behavior. Changing those behaviors will break real-world users (as the
linked paper explained). We can spec as much as we want but until we do the
work to actually migrate these implementations/users, I suspect we'll be
stuck.

Cheers,

Ryan