#24153: Cookie HttpOnly attribute does not use suggested case-style of HTTP
standard
-------------------------------------+-------------------------------------
Reporter: jdufresne | Owner: nobody
Type: | Status: new
Cleanup/optimization |
Component: HTTP handling | Version: master
Severity: Normal | Resolution:
Keywords: | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by berkerpeksag):
If the spec says "HttpOnly attribute name MUST be case-sensitive", I'd
agree with you. However, the grammar described HttpOnly and Secure as
{{{
secure-av = "Secure"
httponly-av = "HttpOnly"
}}}
http://tools.ietf.org/html/rfc6265#section-4.1.1
But again, it's not clear to me. If I'm not mistaken, we(and probably
others) don't really follow accepted RFCs strictly for cookies.
The relevant Python issue is https://bugs.python.org/issue16611 You can
also discuss this by creating a new issue at https://bugs.python.org/, but
since RFC 6265 is not widely implemented and there is no practical issue,
I think it may be rejected. And probably there is a backward compatibility
issue.
There are a couple of RFC 6265 related issues:
* http://bugs.python.org/issue22931
* https://bugs.python.org/issue19670
* https://bugs.python.org/issue22931
--
Ticket URL: <https://code.djangoproject.com/ticket/24153#comment:2>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/067.8016b7b209667bb84165d7e9592b3dcc%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
