Re: [w3ctag/design-reviews] Cookie Store API (#290)

@annevk "rather buggy" isn't very specific / actionable. I would prefer that we focus on concrete concerns.

After reading https://github.com/whatwg/html/issues/804 it seems to me that the problems discussed there fall into two buckets: parsing HTTP header values and character encoding.

This API addresses the parsing issue by switching away from cookie line strings (HTTP header values) to dictionaries where cookie properties are already parsed. Granted, parsing concerns still leak through -- we currently disallow writing a cookie whose name is empty and value contains `=` to avoid parsing ambiguities. More feedback / help in this area is definitely welcome!

We plan to side-step the encoding issue by using USVString in the specification. The proposal currently states that cookie names and values are serialized using UTF-8. While @bsittler really cared about the latter, I don't see a lot of value in internationalizing an internal detail such as cookies, so I'd be fine with heavily restricting the supported cookie names/values (for example, to printable ASCII) if that's what it takes to get consensus here.

I understand the list of problems above may be limited by my perception and experience, and I'm looking forward to learning about any additional concerns you have. I think it would be best to discuss each concern as a separate issue in https://github.com/WICG/cookie-store/issues because I find it hard to follow mega-issues such as https://github.com/whatwg/html/issues/804.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/290#issuecomment-395201007