Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:102949
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain devilix.net designates 74.125.82.41 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAJd4=YZfMgJ7pLwUx_0GqdV+KMCGqYZFhQEDV_2KTMOKiRi6dA@mail.gmail.com>
References: <a4189866-23ea-4dc5-12a4-a7fbad8e5601@genkgo.nl>
 <1abd260d-ebc4-a062-3381-72485946e8bc@gmail.com> <a55b37e3-268c-f8ab-6545-6cf7a4f537f0@genkgo.nl>
 <CAJd4=Ya67XaX3bwwQn20GUQqEvEVe8XEepRz9+of6h4t4fC_fg@mail.gmail.com>
 <CAPhkiZzSfwMd7TthF7jcWwY+JTnFyamyevnWDZZhGGF_qpEpKA@mail.gmail.com> <CAJd4=YZfMgJ7pLwUx_0GqdV+KMCGqYZFhQEDV_2KTMOKiRi6dA@mail.gmail.com>
Date: Sun, 22 Jul 2018 15:16:35 +0300
Message-ID: <CAPhkiZyHTy8m8N9f531GTMcNNhWO7Rj0U9vtMXzg3FhGyJQ0Vg@mail.gmail.com>
To: =?UTF-8?Q?Pedro_Magalh=C3=A3es?= <mail@pmmaga.net>
Cc: "Frederik Bosch | Genkgo" <f.bosch@genkgo.nl>, Stanislav Malyshev <smalyshev@gmail.com>, 
	PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] [VOTE] Same Site Cookie RFC
From: narf@devilix.net (Andrey Andreev)

Hi,

On Sun, Jul 22, 2018 at 2:21 AM, Pedro Magalh=C3=A3es <mail@pmmaga.net> wro=
te:
> On Sat, Jul 21, 2018 at 11:26 PM Andrey Andreev <narf@devilix.net> wrote:
>>
>> Yes.
>>
>> All other "options" are actual *cookie attribute* names, as defined by
>> the various IETF RFCs, while "lifetime" is just a convenient name used
>> by PHP. It doesn't correspond to a particular attribute, but instead
>> the values for the Expires and Max-Age attributes are derived from it.
>> I believe during discussion I insisted that the parameter be called
>> "attributes", for this very reason.
>
>
> Hi,
>
> While I do understand your reasoning, I find it extremely unfriendly to t=
he
> user of the function to ask for one parameter separate from all the other=
s
> for that reason alone.
> Also, keep in mind that all this function does is set the `session.cookie=
_*`
> ini entries. So all parameters are treated equally.
>

Ok, I can see how it can be inconvenient for
session_set_cookie_params(), though calling it "extremely" unfriendly
is some exaggeration IMO. But while I didn't quote that part of your
message, you did also suggest to apply the same decision to other
functions and so I am talking about all of them.

I'd be ok with this for session_set_cookie_params() alone, but not for
set[raw]cookie().

>>
>> On another note, I also wanted that pretty much any key/value pair to
>> be accepted instead of raising an error, for forward compatibility.
>
>
> I really believe that the user spotting errors like `['expries' =3D> time=
() +
> 3600]` faster is more valuable than FC.
>

Honestly, the fact that you chose "expires" for this particular
example IMO only makes a stronger case for why it needs to be
separated. :)

Cheers,
Andrey.