Re: [hunchentoot-devel] hunchentoot cookie-values - url-encode them or not

On Thu, Feb 2, 2012 at 3:13 PM, Ralf Stoye stoye@stoye.com wrote:

1. The standard is RFC 6265, but many people are used to url-encode. url-encoding is the common answer on lists & discussion-groups.
2. I didn't expressed clearly that i also want Hunchentoot to validate AND throwing an error when validation fails.
3. The given http-cookie-value-p is wrong. (doesn't honor the fact that it is allowed to wrap the Token in Doubleqoutes (#x22).
4. your example shows that the decision is not a matter of performance versus simplicity, it's about correctness.

So i vote for a correct implementation, validating the value and throwing an appropriate error.

I'll gladly merge a pull request with a patch that validates cookie values set by the application!

-Hans