AnyEvent::HTTP and "bad" cookies

[Mons Anderson]

On Sat, Jun 19, 2010 at 8:03 PM, Marc Lehmann <schmorp at schmorp.de> wrote:
>
> It helps to talk the truth, and not start spreading fud that anyevent is
> somehow wrong according to unspecified non-standards.
>
>> AnyEvent::HTTP is "wrong", i.e. did't work as expected and like
>> browsers do it. I've been using AE::HTTP for writing robots that works
>
> Thats just empty claims, as I pointed out before. With "browsers" you likely
> mean "IE" and "bug compatible mozilla", but not much else.
>
> again, a more truthful approach to reality would give you much more
> credibility :/
>
> ae::http already contains a shitload of workarounds for various http (and
> cookie) issues, and ae::http does not force any specific cookie parser on
> you.
>
> if you think it does something wrong, you better prove it. so far I only
> received examples of mangled non-http headers and broken cookies.
>

Take a look: I'm not previously saying AE is wrong. I say AE don't
handle wrong things, that are widely spread among the internet.
I'm of course wish the things to work only by RFC and standards.
But in real word we have a lot of services that send wrong responses.

But ok, let's throw out, that sites like google, ebay, and many-many
others emit bad cookies, with undocumented httponly flags or something
else.

You say, you strictly follow the rfc.

Let's take rfc2109.

   set-cookie      =       "Set-Cookie:" cookies
   cookies         =       1#cookie
   cookie          =       NAME "=" VALUE *(";" cookie-av)
   NAME            =       attr
   VALUE           =       value
   cookie-av       =       "Comment" "=" value
                   |       "Domain" "=" value
                   |       "Max-Age" "=" value
                   |       "Path" "=" value
                   |       "Secure"
                   |       "Version" "=" 1*DIGIT

So, this string is rfc-valid cookie:
key1="value"; Path="/"; Secure,key2="value"; Path="/"; Secure

I'm expect to get decoded to be something like

  {
    "/" => {
      key1 => {
        value => "value",
        secure => 1
      },
      key2 => {
        value => "value",
        secure => 1
      },
    }
  }

but I got

  {
    "/" => {
      key1 => {
        value => "value",
        Path => "/"
      }
    }
  }

Next thing.
RFC2109, Section 10.1.2 (HISTORICAL: Expires and Max-Age)

   Netscape's original proposal defined an Expires header that took a
   date value in a fixed-length variant format in place of Max-Age:

   Wdy, DD-Mon-YY HH:MM:SS GMT

   Note that the Expires date format contains embedded spaces, and that
   "old" cookies did not have quotes around values.  Clients that
   implement to this specification should be aware of "old" cookies and
   Expires.

So, the total:

AE::HTTP didn't support Secure flag.
AE::HTTP didn't support unqouted Expires=Wdy, DD-Mon-YY HH:MM:SS GMT

Сonsequently, AE::HTTP didn't implements RFC2109.

-- 
Best wishes,
Vladimir V. Perepelitsa aka Mons Anderson
<inthrax at gmail.com>, <mons at cpan.org>