dwaite / cookiejar

Manage client-side HTTP cookies in Ruby
BSD 2-Clause "Simplified" License
42 stars 69 forks source link

cookiejar should ignore cookie attributes that it does not recognize. #19

Open mgsococo opened 9 years ago

mgsococo commented 9 years ago

Currently, cookiejar raises an exception when a cookie has an attribute/parameter that the cookiejar parser does not recognize. It also fails to parse cookies in headers if it contains unrecognized attributes. It should ignore the attribute rather than raise an exception. This is in violation of all current and former RFCs describing implementation of cookies.

irb(main):008:0> jar.set_cookie(u, 'foo=bar; RandomAttribute=1')
CookieJar::InvalidCookieError: Unknown cookie parameter 'randomattribute'

RFC 6525 4.1.2 "User agents ignore unrecognized cookie attributes (but not the entire cookie)."

RFC 2965 3.3 "The user agent MUST ignore attribute-value pairs whose attribute it does not recognize."

RFC 2109 10.1.1 "An "old" client that receives a "new" cookie will ignore attributes it does not understand; it returns what it does understand to the origin server."