#24153: Cookie HttpOnly attribute does not use suggested case-style of HTTP
standard
--------------------------------------+--------------------
Reporter: jdufresne | Owner: nobody
Type: Cleanup/optimization | Status: new
Component: HTTP handling | Version: master
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Easy pickings: 0 | UI/UX: 0
--------------------------------------+--------------------
See http://tools.ietf.org/html/rfc6265#section-5.2.6
Relevant section:
> 5.2.6. The HttpOnly Attribute
>
> If the attribute-name case-insensitively matches the string "HttpOnly",
the user agent MUST append an attribute to the cookie- attribute-list with
an attribute-name of HttpOnly and an empty attribute-value.
>
> ...
>
> If the cookie-attribute-list contains an attribute with an attribute-
name of "HttpOnly", set the cookie's http-only-flag to true. Otherwise,
set the cookie's http-only-flag to false.
Django creates this attribute as `httponly` not `HttpOnly`.
It is true, this attribute is case insensitive when interpreted by the
user agent, but it seems odd to me that Django would go out of its way to
purposely use different case then stated in the standard. When looking at
other web technologies, the case used in the standard is most typical. The
examples in the standard also use the `HttpOnly` style.
PR to follow.
--
Ticket URL: <https://code.djangoproject.com/ticket/24153>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/052.ec929a66589e8853795b991b59db7c36%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
