Skip to content

Commit 5a76ba6

Browse files
committed
Revamp with more examples and less explanation
Explain when Set-Cookie workaround is needed Also remove a stray line from an example that didn't really hurt but wasn't needed and could have been confusing.
1 parent 8d618d1 commit 5a76ba6

File tree

1 file changed

+28
-11
lines changed

1 file changed

+28
-11
lines changed

src/oas.md

Lines changed: 28 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2526,24 +2526,27 @@ components:
25262526
25272527
##### Representing the `Set-Cookie` Header
25282528

2529-
As noted in [[!RFC9110]] [Section 5.3](https://www.rfc-editor.org/rfc/rfc9110.html#section-5.3) the `Set-Cookie` response header violates the requirements for representing multiple values as a comma-separated list, as `style: "simple"` produces.
2529+
The `Set-Cookie` header is noted in [[!RFC9110]] [Section 5.3](https://www.rfc-editor.org/rfc/rfc9110.html#section-5.3) as an exception to the normal rules of headers with multiple values.
2530+
2531+
For most headers using the general syntax defined in RFC9110, the multiple-line and comma-separaed single-line forms are interchangeable, meaning that this:
25302532

25312533
```http
2532-
Set-Cookie: lang=en-US; Expires=Wed, 09 Jun 2021 10:18:14 GMT
2533-
Set-Cookie: foo=bar; Expires=Wed, 09 Jun 2021 10:18:14 GMT
2534+
Accept-Encoding: compress;q=0.5
2535+
Accept-Encoding: gzip;q=1.0
25342536
```
25352537

2536-
If these values were to be placed on a single line using `style: "simple"`, the result would be `lang=en-US; Expires=Wed, 09 Jun 2021 10:18:14 GMT,foo=bar; Expires=Wed, 09 Jun 2021 10:18:14 GMT`, which when split would then produce four values: `lang=en-US; Expires=Wed`, `09 Jun 2021 10:18:14 GMT`, `foo=bar; Expires=Wed`, and `09 Jun 2021 10:18:14 GMT`.
2537-
While the two dates (`09...`) are not valid `Set-Cookie` values on their own, [[?RFC6265]] does not provide any guarantee that all such embedded uses of commas will produce detectable errors when split in this way.
2538+
is interchangeable with the one-line form that works well with the OAS's `style: "simple"` option:
25382539
2539-
RFC9110 therefore advises recipients to 'handle "Set-Cookie" as a special case while processing fields,' so the OAS similarly applies a special case to its handling of `Set-Cookie`.
2540+
```http
2541+
Accept-Encoding: compress;q=0.5,gzip;q=1.0
2542+
```
25402543
2541-
When an OAS implementation is mapping directly between the multi-`Set-Cookie:` header line format and an array representation, without any intermediate single string holding the multiple values, no special handling is needed as the behavior is the same as for headers that can be either on a single line with comma-separated values or on multiple lines.
2544+
The OAS models such multi-value headers using the one-line form as it matches the behavior of `style: "simple"`, and works well when using `content` as the values are completely separate from the header name, but it does not matter which form is used in an actual HTTP message.
25422545

2543-
However, if a multi-value text representation is needed, such as for a `text/plain` representation (using the `content` field) or in an Example Object, the following special handling is required:
2546+
As also noted in the RFC, `Set-Cookie` is an exception as it allows unquoted, non-escaped commas in its values, and can only use the one-value-per-line form.
2547+
For HTTP messages, this is purely a serialization concern, and no more of a problem than a message that uses the multi-line form of any other header.
25442548

2545-
For the `Set-Cookie` response header _**only**_, `style: "simple"` MUST be treated as producing a newline-delimited list instead of a comma-separated list, with each line corresponding to the value of a single `Set-Cookie:` header field.
2546-
This newline-delimited format MUST be used whenever a string representing the values is required, including in the [Example Object's](#example-object) serialized example fields, and when using `content` with a `text/plain` [Media Type Object](#media-type-object) as is necessary to prevent percent-encoding whitespace.
2549+
However, because examples and values modeled with `content` do not incorporate the header name, for these fields `Set-Cookie` MUST be handled by placing each value on a separate line, without the header name or the `:` delimiter.
25472550

25482551
The following example shows two different ways to describe `Set-Cookie` headers that require cookies named `"lang"` and `"foo"`. The first uses `content` to preserve the necessary whitespace in the `"Expires"` cookie attribute, while the second shows the use of `style: "simple"` and forbids whitespace to ensure that values work with this serialization approach:
25492552
@@ -2564,7 +2567,7 @@ components:
25642567
WithExpires:
25652568
# This demonstrates that the text is required to be provided
25662569
# in the final format, and is not changed by serialization.
2567-
# In practice, it is not necessary to show both fields here.
2570+
# In practice, it is not necessary to show both value fields.
25682571
dataValue: |
25692572
lang=en-US; Expires=Wed, 09 Jun 2021 10:18:14 GMT
25702573
foo=bar; Expires=Wed, 09 Jun 2021 10:18:14 GMT
@@ -2593,6 +2596,20 @@ components:
25932596
foo=bar
25942597
```
25952598
2599+
In an HTTP message, the serialized example with Expires would look like:
2600+
2601+
```http
2602+
Set-Cookie: lang=en-US; Expires=Wed, 09 Jun 2021 10:18:14 GM
2603+
Set-Cookie: foo=bar; Expires=Wed, 09 Jun 2021 10:18:14 GMT
2604+
```
2605+
2606+
and the example without Expires would look like:
2607+
2608+
```http
2609+
Set-Cookie: lang=en-US
2610+
Set-Cookie: foo=bar
2611+
```
2612+
25962613
##### Header Object Example
25972614
25982615
A simple header of type `integer`:

0 commit comments

Comments
 (0)