Hi friends,

I've recently joined the discussions in the IETF http-state list where the job
is set out to document existing cookie practices to eventually get a document
that describes how to implement cookies (the netscape being the best one to
date, and calling that a spec is quite a stretch).

The other day we hit the subject of which order to send the cookies in the
Cookie: request header, and apparently the 5 major browsers all sort the
cookies in a specific way in the header they send.

libcurl does no such sorting, but will instead just send the cookies in the
order it holds them internally.

Can anyone figure out a site or server-side implementation that in any way
breaks or is dependent on a particular order of the sent cookies? In my own
experience, libcurl's cookie handling is very compliant with the world's
server side implementations so I was a bit surprised to learn about the
browsers sorting habits.

I argue that specifying the order is unnecessary. Am I wrong?

-- 
  / daniel.haxx.se