Hi,
Sorry for the late answer.
On Thu, Oct 29, 2009 at 12:12:25PM +0100, Marc Lehmann wrote:
> Package: iceweasel
> Version: 3.0.6-3
> Severity: normal
>
>
> Iceweasel sends malformed Cookie:-headers. A common example are cookies from
> google-analytics, leading to this Cookie:-header:
>
> Cookie: __utma=73875437.8485834585.4574587886.4535834548.4574587458.1;
> __utmz=83474878.9498399889.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
> __utmv=77383838.Lead
>
> The problem here is the __utmz cookie, which contains seperator characters
> (neither "=", "(", nor ")" are allowed unquoted).
>
> I tested three server backend implementations and all stop parsing at the
> first "=".
>
> This is often not an issue as those cookies come last, but when an
> application-specific cookie comes after those, many implementations fail
> to see it because of the mangled cookie value.
>
> (the definition of an unquoted value can be found e.g. in rfc2616).
>
> The solution is to properly quote the value (as quoted-string).
The fact is, even the servers are not quoting the = signs in the
Set-Cookie headers... RFC 2616 doesn't talk about cookies, but RFC 2109
does, and i do agree the property should be quoted. OTOH, as it
apparently works with the current way, I wonder...
Mike
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
