Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Add link to patch for changes to Cookie

...

indent
Allow cookies whose name is null or the empty string. Browsers will store a single cookie that has no name whose value is sent as simply «value» (i.e. without any '=' delimiter). This would now be supported if STRICT_NAMING is set to "netscape" but would remain disallowed in "rfc2109" or "rfc6265" modes. If allowed, the Set-Cookie header would contain just the value (no '=' present and an IAE if value contained an '=') and any such cookie found during parsing would be included in the result of [HttpServletRequest]#getCookies().

A candidate patch for these Cxx changes can be found here:
http://people.apache.org/~jboynes/patches/cookie.patch This follows proposal C1 with the consequence that a "/" is not allowed in a cookie name by default; to allow that STRICT_NAMING must be set to false (i.e. to "netscape" mode). The test suite changes are a result of that and with them in place I have verified it still passes.

Changes to generation of Set-Cookie header

...