Fixing a parsing problem for cookie data.

[wladston]

Quotes are valid to appear surrounding cookie data, and thus should not
be removed.

[mcdonc]

I have to plead ignorance on this. Do you have any citation for your assertion that the current behavior is incorrect?

[wladston]

mcdonc, I think all ASCII characters are valid to be part of cookie-data, including the quotation mark character. I searched a little bit and found nothing related to invalid formats of cookies, or forbidden cookie characters.

[mcdonc]

I'll probably need to see some positive evidence before changing things.

[wladston]

The thing is, changing the informed cookie data just seems plain wrong to me. Check the unit test at issue #103, if you think that test should really fail, then you can discard this pull request.

[digitalresistor]

Since I was bored ...

Read a bunch of RFC's and all that fun stuff, and here is the relevant one:

http://tools.ietf.org/html/rfc6265#section-4.1.1

More specifically it states that characters in the following ranges are valid:

%x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E

Which equals this:

0x21: !
0x23-2B: #$%&'()*+
0x2D-3A: -./0123456789: 
0x3C-5B: <=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[
0x5D-7E: ]^_`abcdefghijklmnopqrstuvwxyz{|}~

Specifically it states this:

                   ; US-ASCII characters excluding CTLs,
                   ; whitespace, DQUOTE, comma, semicolon,
                   ; and backslash

The only time the DQUOTE (double quote) is allowed to appear is around the cookie-octet:

cookie-value      = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )

Basically cookie-octet with quotes surrounding it is the same as cookie-octet without the surrounding double quotes.

Thus "cookie-val" is the same as cookie-val, and expecting the double quotes to be preserved as part of the cookie value is wrong since the spec states they are not a valid part of the cookie-octet.

@wladston: If you want to store data that is outside of the characters listed above, may I suggest base64 encoding the data.

@mcdonc: The current way WebOb handles this is valid.

[wladston]

@bertjwregeer, impressive, you are correct. Thanks for the research!