State
Click on the red underlined text to get to the source
...
Because it was used in Netscape's original implementation of state
management, we will use the term cookie to refer to the state
...
... Because it was used in Netscape's original implementation of state
management, we will use the term cookie to refer to the state
information that passes between an origin server and user agent, and
...
... client request without relating that request to previous or
subsequent requests; the state management mechanism allows clients
and servers that wish to exchange state information to place HTTP
requests ...
... subsequent requests; the state management mechanism allows clients
and servers that wish to exchange state information to place HTTP
requests and responses within a larger context, which we term a
...
...
We describe here a way for an origin server to send state information
to the user agent, and for the user agent ...
... to the user agent, and for the user agent to return the state
information to the origin server. The goal is to have a minimal
impact on HTTP ...
... origin server if it chooses to continue a session. The origin server
MAY ignore it or use it to determine the current state of the
session. It MAY send back to the client ...
... REQUIRED. The name of the state information ("cookie") is NAME,
and its value is VALUE. NAMEs that begin with $ are reserved and
...
... integer,
identifies the version of the state management specification to
which the cookie conforms. For this specification, Version ...
... The user agent keeps separate track
of state information that arrives via Set-Cookie2 response headers
...
...
One reason for separating state information from both a URL and
document content is to facilitate the scaling that caching permits.
...
...
Here we provide guidance on likely or desirable details for an origin
server that implements state management.
...
...
An origin server's content should probably be divided into disjoint
application areas, some of which require the use of state
information. The application areas can be distinguished by their
request URLs ...
... The session information can obviously be clear or encoded text that
describes state. However, if it grows too large, it can become
unwieldy. Therefore, an implementor might choose for the session
information ...
... a database creates some problems that this state management
specification was meant to avoid, namely:
...
... keeping real state on the server side; ...
... Caching benefits the scalability of WWW. Therefore it is important
to reduce the number of documents that have state embedded in them
inherently. For example, if a shopping-basket-style application
always displays a user's current basket contents on each page, those
...
... Identity might become evident, for example, if a user
subsequently fills out a form that contains identifying information.)
This state management specification therefore requires that a user
agent give the user control over such a possible intrusion, although
the interface ...
...
A user agent usually begins execution with no remembered state
information. It SHOULD be possible to configure a user agent never
...
... to send Cookie headers, in which case it can never sustain state with
an origin server. (The user agent would then behave like one that is
...
... When the user agent terminates execution, it SHOULD let the user
discard all state information. Alternatively, the user agent MAY ask
the user whether state ...
... state information. Alternatively, the user agent MAY ask
the user whether state information should be retained; the default
should be "no". If the user chooses to retain state information, it
...
... the user whether state information should be retained; the default
should be "no". If the user chooses to retain state information, it
would be restored the next time the user agent runs.
...
... 2109(-> 2965prop), three other proposals have been made to
accomplish similar goals. This specification began as an amalgam of
Kristol's State-Info proposal [DMK95] and Netscape's Cookie proposal
...
... agent-initiated and could be used by an origin server to track
"clicktrails". It would not carry any origin-server-defined state,
however. Phillip Hallam-Baker has proposed another client-defined
...
... Kristol, D.M., "Proposed HTTP State-Info Mechanism", available at <http://portal.research.bell-labs.com/~dmk/state-info.html>, September, 1995. ...
... "Persistent Client State -- HTTP Cookies", available at <http://www.netscape.com/newsref/std/cookie_spec.html ...
... Kristol, D. and L. Montulli, "HTTP State Management Mechanism", RFC 2109(-> 2965prop), February 1997. ...