reisub / http_cookie Goto Github PK

Being able to parse set-cookie strings is cool and all, but having a full cookie jar implementation will make it easier for users of the lib.

This is optional in the spec:

At any time, the user agent MAY "remove excess cookies" from the
cookie store if the number of cookies sharing a domain field exceeds
some implementation-defined upper bound (such as 50 cookies).

At any time, the user agent MAY "remove excess cookies" from the
cookie store if the cookie store exceeds some predetermined upper
bound (such as 3000 cookies).

When the user agent removes excess cookies from the cookie store, the
user agent MUST evict cookies in the following priority order:

1. Expired cookies.

2. Cookies that share a domain field with more than a predetermined
   number of other cookies.

3. All cookies.

If two cookies have the same removal priority, the user agent MUST
evict the cookie with the earliest last-access date first.

When "the current session is over" (as defined by the user agent),
the user agent MUST remove from the cookie store all cookies with the
persistent-flag set to false.

It's a good idea to have some limits to guard against DOS attacks. A malicious server could keep creating cookies until the client memory is exhausted.