Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.javascript > #29971
| From | Thomas 'PointedEars' Lahn <PointedEars@web.de> |
|---|---|
| Newsgroups | comp.lang.javascript |
| Subject | Re: Difference between client and server side cookie |
| Date | 2016-03-14 01:54 +0100 |
| Organization | PointedEars Software (PES) |
| Message-ID | <4382627.JkLruRRTPY@PointedEars.de> (permalink) |
| References | (3 earlier) <nc287b$frb$1@dont-email.me> <XnsA5CA6DFFFD47Eeejj99@194.109.6.166> <87wpp67j6w.fsf@bsb.me.uk> <2325956.yKQUHyJ2TD@PointedEars.de> <87y49m54i6.fsf@bsb.me.uk> |
Ben Bacarisse wrote:
> Thomas 'PointedEars' Lahn <PointedEars@web.de> writes:
>> Ben Bacarisse wrote:
>>> He's saying that there are sometimes cookies "on the server" --
>>> specifically they are sent there every time a client makes a request for
>>> which a cookie is relevant.
>>
>> In fact, only cookie *names* and *values* are sent with every HTTP
>> request that applies to their “domain”, “path” and “secure” attributes,
>> unless they have expired (as specified by the “expires” attribute in a
>> former HTTP response header “Set-Cookie” field value or in the value
>> assigned to the document.cookie property).
>>
>>> Where are they while the server is using them if not "on the server"?
>>
>> Still stored on the client machine.
>
> And on the server while the server is processing the request.
Nonsense.
>> Cookies are data (stored in local files) only whose *names* and *values*
>> are incorporated into a HTTP request header “Cookie” field value.
>
> But it is not a cookie only when in some client's store.
Yes, it is.
> The RFC (6265) defines a cookie as a name/value pair
No, it does not:
| 4.2.2. Semantics
|
| Each cookie-pair represents a cookie stored by the user agent. The
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
| cookie-pair contains the cookie-name and cookie-value the user agent
| received in the Set-Cookie header.
|
| Notice that the cookie attributes are not returned. […]
> and it is still a cookie as that name/value pair is sent over the wire.
No, it is not. A representation is _not_ the real thing. Like in
ECMAScript where a string representation of an object is _not_ the object
itself.
> This is clear from the language the RFC uses:
Your interpretation is not supported by that RFC; in fact, it is refuted by
that.
> "The semantics of individual cookies in the Cookie header are not
> defined"
>
> "if the Cookie header contains two cookies with the same name"
>
> "if the user agent fails to return one or more cookies in the Cookie
> header"
By the RFCs own definition, the Cookie header (field) value is _not_ a
cookie, too. It is a comma-separated list of cookie name-value pairs
(“cookie-pairs”) sent by the client to the server. The RFC is
contradicting itself here partially, due to imprecise wording.
> "The active network attacker can intercept these cookies"
>
> "the user agent will include that cookie in HTTP requests"
Fallacy: Straw man. The first phrase is referring to the information sent
from the server to the client, not vice-versa, as the value of each
“Set-Cookie” *response* header field does constitute a cookie on the client
*if it is stored there*. As for the second phrase, see above.
> and so on.
Fallacy: Hasty generalization.
> It is perfectly reasonable to talk of the cookie in transit,
> in the header and arriving (to be stored however temporarily) on the
> server.
No, it is not.
>>> It's a small point, but it's not wrong.
>>
>> Yes, it is.
>>
>> <https://en.wikipedia.org/wiki/HTTP_cookie#Implementation>
>
> The RFC is definitive. If this Wikipedia article contradicts it,
> Wikipedia needs to be corrected.
You are, in the best case, misinterpreting the RFC (which is only a
*Proposed* Standard now, so in no way definitive; see RFC 2026, §4.4.1)
completely. In the worst case, you are quoting from it selectively
deliberately in order to support your opinion. Fallacy: Cherry picking.
--
PointedEars
FAQ: <http://PointedEars.de/faq> | SVN: <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | ES Matrix: <http://PointedEars.de/es-matrix>
Please do not cc me. / Bitte keine Kopien per E-Mail.
Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Difference between client and server side cookie bit-naughty@hotmail.com - 2016-03-12 05:38 -0800
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-12 15:02 +0100
Re: Difference between client and server side cookie Stefan Weiss <krewecherl@gmail.com> - 2016-03-12 16:19 +0100
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-12 23:32 +0100
Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-12 20:23 -0300
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-13 10:48 +0100
Re: Difference between client and server side cookie Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-03-13 10:42 +0000
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-13 12:05 +0100
Re: Difference between client and server side cookie Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-03-13 11:46 +0000
Re: Difference between client and server side cookie Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-03-13 13:46 +0100
Re: Difference between client and server side cookie bit-naughty@hotmail.com - 2016-03-13 07:07 -0700
Re: Difference between client and server side cookie Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-03-13 16:34 +0100
Re: Difference between client and server side cookie Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-03-13 23:42 +0000
Re: Difference between client and server side cookie Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-03-14 01:54 +0100
Re: Difference between client and server side cookie Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-03-14 10:36 +0100
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-14 11:43 +0100
Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-14 10:21 -0300
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-14 15:01 +0100
Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-14 11:52 -0300
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-14 17:06 +0100
Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-14 13:17 -0300
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-14 19:43 +0100
Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-14 16:17 -0300
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-14 23:22 +0100
Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-14 19:38 -0300
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-14 23:44 +0100
Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-14 21:49 -0300
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-15 10:18 +0100
Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-15 11:39 -0300
Re: Difference between client and server side cookie John Harris <niam@jghnorth.org.uk.invalid> - 2016-03-15 09:40 +0000
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-15 12:08 +0100
Re: Difference between client and server side cookie Stefan Weiss <krewecherl@gmail.com> - 2016-03-15 13:22 +0100
Re: Difference between client and server side cookie "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-03-15 15:53 +0100
Re: Difference between client and server side cookie Aleksandro <aleksandro@gmx.com> - 2016-03-13 13:51 -0300
Re: Difference between client and server side cookie bit-naughty@hotmail.com - 2016-03-13 07:09 -0700
csiph-web