cookies - Understanding RFC6265 domain-matching conditions -
i'm looking implement straightforward method check if given cookie domain domain-matches given hostname.
to implementing domain matching conditions defined in section 5.1.3 of rfc 6265.
the second of 2 matching conditions defined multipart condition 3 sub-conditions apply:
all of following conditions hold:
- the domain string suffix of string.
- the last character of string not included in domain string %x2e (".") character.
- the string host name (i.e., not ip address).
for clarity, when above quoted text refers "the string" referring domain value of cookie , when above quoted text refers "the domain name" referring domain name of host cookies might sent.
of these 3 sub-conditions, first , third quite clear. wording of second finding confusing.
i know cookie domain of "example.com" matches "example.com" , cookie domain of ".example.com" matches "<anything>.example.com". best guess above second sub-condition if referring broad subdomain matching concept, given wording can't sure.
is able translate second sub-condition plain technical english?
according section 4.1.2.3 of rfc 6265
for example, if value of domain attribute "example.com", user agent include cookie in cookie header when making http requests example.com, www.example.com, , www.corp.example.com. (note leading %x2e ("."), if present, ignored though character not permitted, trailing %x2e ("."), if present, cause user agent ignore attribute.)
so logic be:
1. check targetstring endswith domain 2. check lastchar(targetstring) != "." 3. check targetstring host name
Comments
Post a Comment