# [PATCH] Addition of setcookie2() to support RFC 2965

- Thread: https://externals.io/message/31905
- Original archive: https://news-web.php.net/php.internals/31905
- Started by Ben Ramsey on 2007-08-25T06:35:31+00:00
- Messages: 3
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #31905 — Ben Ramsey — 2007-08-25T06:35:31+00:00

URL: https://externals.io/message/31905#31905

Here is a patch I am submitting as a recommendation to implement a 
setcookie2() function to support the Set-Cookie2 response header defined 
in RFC 2965.

RFC 2965 obsoletes the original Netscape cookie specification and RFC 
2109. Unfortunately, the only major browser I can find that implements 
Cookie2 and Set-Cookie2 from the client side is Opera. Nevertheless, the 
Set-Cookie2 header provides improvements over the original Set-Cookie 
header:

1) Clients can provide users with more control over what they accept and 
show them the provided Comment or a link to the CommentURL, allowing the 
application can tell the user how it is using the specific cookie.

2) Discard and Max-Age provide better control over cookie expiration and 
deletion. (Expires is not present.)

3) Port provides the ability to specify a list of ports for which the 
cookie is valid (at the given Domain).

There are a few statements in RFC 2965 that this patch does not cover:

"When it receives a Cookie header, the origin server SHOULD treat 
cookies with NAMEs whose prefix is $ specially, as an attribute for the 
cookie."

"User agents that receive in the same response both a Set-Cookie and 
Set-Cookie2 response header for the same cookie MUST discard the 
Set-Cookie information and use only the Set-Cookie2 information." (If 
the user agent obeys this rule, then this could potentially cause a 
problem setting PHPSESSID with Set-Cookie and setting cookies with 
setcookie2() in the same response.)

-- 
Ben Ramsey
http://benramsey.com/

---

## #31906 — Stanislav Malyshev — 2007-08-25T20:58:48+00:00

URL: https://externals.io/message/31905#31906 · In reply to: #31905

> Here is a patch I am submitting as a recommendation to implement a 
> setcookie2() function to support the Set-Cookie2 response header defined 
> in RFC 2965.

I think setcookie2 can ve useful, but a function with 13 arguments is a 
monster. Especially that you may not use all of them. Maybe it's better 
to have them as an array of secondary parameters?
-- 
Stanislav Malyshev, Zend Software Architect
stas@zend.com   http://www.zend.com/
(408)253-8829   MSN: stas@zend.com

---

## #31907 — Ben Ramsey — 2007-08-25T21:13:57+00:00

URL: https://externals.io/message/31905#31907 · In reply to: #31906

> > […]
> 
> I think setcookie2 can ve useful, but a function with 13 arguments is a 
> monster. Especially that you may not use all of them. Maybe it's better 
> to have them as an array of secondary parameters?

Yep. Sara already suggested this to me, so I'm working on a new patch 
for this.

Thanks!

-- 
Ben Ramsey
http://benramsey.com/