Re: p:http-request: required cookie support?

Florent Georges <fgeorges@fgeorges.org> writes:
>     This test checks to see if an p:http-request preserves cookies
>     across an HTTP redirect.
>
>   Is it really a required feature?  If it is, shouldn't it be
> stated explicitly in the recommendation?  (personally, I am not
> sure this would be a good thing, but I am not a cookie expert)

The current editor's draft includes a new section 7.1.10.3.2 (good grief!)
that makes the statement explicitly in the spec.

It is worded as a "SHOULD". Implementations that can't, or have a good
reason not to implement it, can decline to do so on this basis.

On the other hand, given that it is apparently common practice to use
this "trick" in some web service authentication scenarios, the WG
feels that it is promoting both utility and interoperabilty by
encouraging implementors to support it.

Please let us know if you do not find this rationale satisfactory.

                                        Be seeing you,
                                          norm

-- 
Norman Walsh <ndw@nwalsh.com> | In every work of genius we recognize
http://nwalsh.com/            | our own rejected thoughts; they come
                              | back to us with a certain alienated
                              | majesty.-- Emerson