HTTP 状态管理机制 (Cookie) 的当前状态
我想知道是否有关于浏览器符合三个 Cookie 规范的当前状态的调查或报告：Netscape 的原始草案，RFC 2109，以及废弃 RFC 2109 的 RFC 2965。
我知道，由于其年代久远，Netscape 的草案将得到大多数客户的支持。但有些人建议不要再使用它，例如 这个Apache的HttpClient教程：
Netscape 草案： 此规范符合 Netscape Communications 发布的原始规范草案。除非绝对有必要与遗留代码兼容，否则应该避免这样做。
那么其他规格呢？它们准备好使用了吗？
I was wondered whether there is a survey or report of the current state of browser compliance with the three Cookie specifications: Netscape’s original draft, RFC 2109, and RFC 2965 that obsoletes RFC 2109.
I know that, due to its age, Netscape’s draft will be supported by most clients. But some recommend not to use it any more, e.g. this tutorial on Apache’s HttpClient:
Netscape draft: This specification conforms to the original draft specification published by Netscape Communications. It should be avoided unless absolutely necessary for compatibility with legacy code.
So what about the other specification? Are they ready to be used yet?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
共识似乎是它们还没有准备好使用。 这里提到了一些原因和主要与浏览器合规性有关。
然而，凭直觉，我怀疑您提出这个问题的动机可能与会话劫持问题有关，该问题已被诸如
如果是这样的话，我发现了一篇有趣的论文，提出了一种名为 OTC 的问题的解决方案——一次性 cookie。这可能值得一读。它的标题是 一次性 Cookie：使用一次性凭据防止会话劫持攻击，来自 4佐治亚理工学院的博士生。
（如果谷歌文档链接不起作用，这里是 PDF 的直接链接。）
总而言之，它基本上得出结论：
...
这是一本非常有趣的读物。我希望能以某种方式帮助某人，
〜gMale
The consensus seems to be that they still aren't ready to be used yet. Some of the reasons for that are mentioned here and mostly relate to browser compliance.
However, on a hunch, I suspect your motive for asking this might relate to the session hijacking problem that has been brought into the limelight by applications like FireSheep.
If that's the case, I came across an interesting paper proposing a solution to the problem called OTC's—one-time cookies. It might be worth a read. It's title is One-Time Cookies: Preventing Session Hijacking Attacks with Disposable Credentials and it's from 4 PhD students at Georgia Tech.
(In case that google Docs link doesn't work here's a direct link to the PDF.)
In summary, it basically concludes:
...
It's a very interesting read. I hope that helps someone in some way,
~gMale
最新的调查似乎是 Ka-Ping Yee 在 2002 年撰写的调查，在 WWW/Internet 的发展过程中被认为是古老的。好处是它调查了 3 个操作系统中的 12 个浏览器，这可以让我们对它们如何适应 cookie 管理有一个公平的了解。
另一篇更新的文章，虽然不太相关，是由 Yue、Xie 和 Wang 撰写的2009 年（2010 年出版）。它对超过5000个网站进行了大规模的HTTP cookie管理研究，使用了一个可以自动验证网站cookie的有用性并代表用户设置cookie使用权限的系统。
The most recent survey out there seems to be the one written by Ka-Ping Yee in 2002, which is considered ancient in the evolution of WWW/Internet. The upside is that it surveyed 12 browsers across 3 OSs, which may give an fair insight about how they adapted cookie management.
Another more recent article, although less relevant, is written by Yue, Xie, and Wang in 2009 (published in 2010). It conducted a large-scale study on HTTP cookie management with more than 5000 websites, using a system that can automatically validate the usefulness of cookies from a website and set the cookie usage permission on behalf of users.
您可能需要检查
http://lists.w3.org/ Archives/Public/www-tag/2011Mar/0021.html
指的是
http://www.ietf.org/id/draft-ietf-httpstate-cookie-23.txt
这旨在废弃 RFC 2965。
You might want to check
http://lists.w3.org/Archives/Public/www-tag/2011Mar/0021.html
which refers to
http://www.ietf.org/id/draft-ietf-httpstate-cookie-23.txt
This is intended to obsolete RFC 2965.