Subject: Re: [websec] of quoted-string header field param value syntax (was: Strict-Transport-Security syntax redux)

From: "Manger, James H" <[email-masked]>
Date: Mon, 16 Jan 2012 22:43:35 +1100

> agreed. that's why I'm leaning towards spec'g it with quoted-string at this time. It future-proofs the spec

Quoted-string provides no "future-proofing". <token> supports about 77 chars; <quoted-string> adds about 18 more -- there are another 100,000 chars to support (and even more code points) if you actually want future- proofing.

Supporting quoted-string is all about past compromises. It adds no value to a new header.

Consistency with other headers is theoretically valuable, but consistency without the limits (no unicode...) and baggage (ISO8849-1...) of quoted-string would be considerably better.

--
James Manger

---

From: Julian Reschke <[email-masked]>
Date: Mon, 16 Jan 2012 13:22:02 +0100

On 2012-01-16 12:43, Manger, James H wrote:
> Quoted-string provides no "future-proofing".<token>  supports about 77 chars;<quoted-string>  adds about 18 more -- there are another 100,000 chars to support (and even more code points) if you actually want future- proofing.
>

Well, it allows putting in ASCII characters not allowed otherwise, such 
as whitespace and delimiters such as ";", "," and double quotes.

I agree it doesn't help with I18N.

 > ...

Best regards, Julian