1.  Each session has a beginning and an end.

      2.  Each session is relatively short-lived.

      3.  Either the user agent or the origin server may terminate a
          session.

      4.  The session is implicit in the exchange of state information.





 
RFC 2109            HTTP State Management Mechanism        February 1997


4.  OUTLINE

   We outline here a way for an origin server to send state information
   to the user agent, and for the user agent to return the state
   information to the origin server.  The goal is to have a minimal
   impact on HTTP and user agents.  Only origin servers that need to
   maintain sessions would suffer any significant impact, and that
   impact can largely be confined to Common Gateway Interface (CGI)
   programs, unless the server provides more sophisticated state
   management support.  (See Implementation Considerations, below.)

4.1  Syntax:  General

   The two state management headers, Set-Cookie and Cookie, have common
   syntactic properties involving attribute-value pairs.  The following
   grammar uses the notation, and tokens DIGIT (decimal digits) and
   token (informally, a sequence of non-special, non-white space
   characters) from the HTTP/1.1 specification [RFC 2068] to describe
   their syntax.

   av-pairs        =       av-pair *(";" av-pair)
   av-pair         =       attr ["=" value]        ; optional value
   attr            =       token
   value           =       word
   word            =       token | quoted-string

   Attributes (names) (attr) are case-insensitive.  White space is
   permitted between tokens.  Note that while the above syntax
   description shows value as optional, most attrs require them.

   NOTE: The syntax above allows whitespace between the attribute and
   the = sign.

4.2  Origin Server Role

4.2.1  General

   The origin server initiates a session, if it so desires.  (Note that
   "session" here does not refer to a persistent network connection but
   to a logical session created from HTTP requests and responses.  The
   presence or absence of a persistent connection should have no effect
   on the use of cookie-derived sessions).  To initiate a session, the
   origin server returns an extra response header to the client, Set-
   Cookie.  (The details follow later.)

   A user agent returns a Cookie request header (see below) to the
   origin server if it chooses to continue a session.  The origin server
   may ignore it or use it to determine the current state of the




 
RFC 2109            HTTP State Management Mechanism        February 1997


   session.  It may send back to the client a Set-Cookie response header
   with the same or different information, or it may send no Set-Cookie
   header at all.  The origin server effectively ends a session by
   sending the client a Set-Cookie header with Max-Age=0.

   Servers may return a Set-Cookie response headers with any response.
   User agents should send Cookie request headers, subject to other
   rules detailed below, with every request.

   An origin server may include multiple Set-Cookie headers in a
   response.  Note that an intervening gateway could fold multiple such
   headers into a single header.

4.2.2  Set-Cookie Syntax

   The syntax for the Set-Cookie response header is

   set-cookie      =       "Set-Cookie:" cookies
   cookies         =       1#cookie
   cookie          =       NAME "=" VALUE *(";" cookie-av)
   NAME            =       attr
   VALUE           =       value
   cookie-av       =       "Comment" "=" value
                   |       "Domain" "=" value
                   |       "Max-Age" "=" value
                   |       "Path" "=" value