Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:64229
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.210.169 as permitted sender)
MIME-Version: 1.0
Sender: julienpauli@gmail.com
In-Reply-To: <20121210142818.9erzxulg08cwwck8@mail.orbitel.bg>
References: <20121210142818.9erzxulg08cwwck8@mail.orbitel.bg>
Date: Mon, 10 Dec 2012 15:01:07 +0100
Message-ID: <CAMUwpuSOW1=tht0j5VR3cS5_Meny4jorj-Dg5DaRR4F52YjAag@mail.gmail.com>
To: Andrey Andreev <narf@bofh.bg>
Cc: internals@lists.php.net
Content-Type: multipart/alternative; boundary=14dae934123594711a04d08001e1
Subject: Re: [PHP-DEV] Bug #23955: Cookie Max-Age attribute
From: jpauli@php.net (jpauli)

--14dae934123594711a04d08001e1
Content-Type: text/plain; charset=ISO-8859-1

On Mon, Dec 10, 2012 at 1:28 PM, Andrey Andreev <narf@bofh.bg> wrote:

> Hello all,
> On a pull request submitted via github, it was suggested to me that I
> should write an RFC about the feature that I'm proposing as well as to
> write about it here on the internals mail list.
> However, creating new pages (including RFCs) on wiki.php.net doesn't seem
> to be allowed for non-priviled users, so I'm forced to skip that part.
>
> The PR in question is located at the URL below, but note that I'm no C
> coder and while I did test it, I'm in no way confident that it should be
> implemented as is. The changes just seemed simple enough to do, so I went
> with it. If not anything else, you should be able to understand it more
> easily.
>
> https://github.com/php/php-**src/pull/238<https://github.com/php/php-src/pull/238>
>
> What I'm proposing is that setcookie(), setrawcookie() and ext/session
> should send the Max-Age attribute in the Set-Cookie header, as described in
> RFC2109, RFC2965, RFC6265.
>
> As shown in the subject, the absence of this attribute in PHP-generated
> Set-Cookie headers is also listed as a bug: https://bugs.php.net/bug.php?*
> *id=23955 <https://bugs.php.net/bug.php?id=23955>
>
> Another one also related: https://bugs.php.net/bug.php?**id=43439<https://bugs.php.net/bug.php?id=43439>
>
> In summary - it specifies the cookie lifetime in seconds, starting from
> the current time. This means that it's a better solution than the Expires
> attribute, as the user agent doesn't need to worry about timezones and
> basically - it doesn't matter if its time settings are correct.
>
> It should also be noted that 0 (zero) or any negative value means that the
> cookie should be immediately dropped.
>
> Erroneous time settings is a problem for many users and for the developers
> of web applications that they report this supposedly as a bug and since
> I've personally faced such reports, I can tell - it's really hard to debug
> and/or figure out the problem at first. Considering this, I can imagine
> that this feature would solve a lot of problems.
>
> The listed RFCs specify that both Expires and Max-Age are optional
> attributes, but due to the latter being relatively new - it might not be
> supported by all browsers. Those that don't will ignore it, BUT those that
> do - will give it a higher precedence.
> To me, that makes it perfectly safe to send both Expires and Max-Age,
> whenever the cookie lifetime has to be specified.
>
> I've taken the chance to also switch the rest of the currently sent
> attributes from all-lowercase to the so called StudlyCaps presentation
> (e.g. expires -> Expires). Browsers should all match them in a
> case-insensitive manner, but all of the RFCs list them as proposed. In
> other words - this is irrelevant, why not do it for the sake of consistency?
>
> Btw, since the patch is against 'master', while compiling it appeared that
> it's PHP 5.5 code in that branch. That's not intentional on my part - if it
> was up to me, I'd include it in the very next release. :)
>
> Cheers,
> Andrey.
>
> Thx Andrey for this,

As I noted in a bug comment https://bugs.php.net/bug.php?id=23955 , this
feature must be added to PHP for User Agent having a wrong local time to
compute cookie expiration in a safe way.

The fact that adding the header should just not change the behavior of UA's
not knowing it is a huge +1.
I dont like the idea of adding one more parameter to setcookie() and
friends to let the programmer control the generated headers (talked about
in the github issue comments)

Julien.Pauli


>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>

--14dae934123594711a04d08001e1--