You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@wicket.apache.org by Martin Grigorov <mg...@apache.org> on 2014/07/23 16:31:31 UTC
CookieUtils multivalued support broken since a while
Hi,
At https://issues.apache.org/jira/browse/WICKET-5648 we identified that the
support for a cookie with several values is broken.
CookieUtils uses FormComponent#VALUE_SEPARATOR to separate the values.
The problem is that VALUE_SEPARATOR is ";" - a semicolon is not allowed
neither in the value nor the name. It is actually used as a separator
between the key/value pairs.
The question is how to fix this ?
The reporter suggested to use URL encoding for the values.
https://developer.mozilla.org/en-US/docs/Web/API/document.cookie also
suggests the same.
The problem is that this is a behavior change - an application may use
values with '/', for example, and read them in JS. If we apply URL encoding
then the app will break. To fix it it will have to use
decodeURIComponent(theValue) at the client side.
Since no one complained about the broken value separator for the last 7
years I suggest to leave like it is now and fix it only in Wicket 7.x.
Other ideas ?
Additionally CookieUtils provide save() and load() methods that work with
FormComponent. I guess they have been used for the IValuePersister impls in
Wicket 1.3.x. At the moment Wicket doesn't use them. The only usage is in
the unit tests.
Should we keep them around or deprecated them and remove in Wicket 7.x/8.x ?
Martin Grigorov
Wicket Training and Consulting
https://twitter.com/mtgrigorov
Re: CookieUtils multivalued support broken since a while
Posted by Martijn Dashorst <ma...@gmail.com>.
deprecate and remove in 7.x
On Mon, Aug 4, 2014 at 12:11 PM, Martin Grigorov <mg...@apache.org> wrote:
> I'm also in favor to deprecate the multivalue related methods in 6.x and
> remove them in 7.x
>
> Martin Grigorov
> Wicket Training and Consulting
> https://twitter.com/mtgrigorov
>
>
> On Fri, Jul 25, 2014 at 3:09 PM, Sven Meier <sv...@meiers.net> wrote:
>
>> [+1] deprecated them and remove in Wicket 7.x/8.x ?
>>
>> Remove them and anything related to multi-valued cookies too.
>>
>> Regards
>> Sven
>>
>>
>>
>>
>> On 07/23/2014 04:31 PM, Martin Grigorov wrote:
>>
>>> Hi,
>>>
>>> At https://issues.apache.org/jira/browse/WICKET-5648 we identified that
>>> the
>>> support for a cookie with several values is broken.
>>> CookieUtils uses FormComponent#VALUE_SEPARATOR to separate the values.
>>> The problem is that VALUE_SEPARATOR is ";" - a semicolon is not allowed
>>> neither in the value nor the name. It is actually used as a separator
>>> between the key/value pairs.
>>>
>>> The question is how to fix this ?
>>>
>>> The reporter suggested to use URL encoding for the values.
>>> https://developer.mozilla.org/en-US/docs/Web/API/document.cookie also
>>> suggests the same.
>>> The problem is that this is a behavior change - an application may use
>>> values with '/', for example, and read them in JS. If we apply URL
>>> encoding
>>> then the app will break. To fix it it will have to use
>>> decodeURIComponent(theValue) at the client side.
>>> Since no one complained about the broken value separator for the last 7
>>> years I suggest to leave like it is now and fix it only in Wicket 7.x.
>>>
>>> Other ideas ?
>>>
>>> Additionally CookieUtils provide save() and load() methods that work with
>>> FormComponent. I guess they have been used for the IValuePersister impls
>>> in
>>> Wicket 1.3.x. At the moment Wicket doesn't use them. The only usage is in
>>> the unit tests.
>>> Should we keep them around or deprecated them and remove in Wicket
>>> 7.x/8.x ?
>>>
>>>
>>> Martin Grigorov
>>> Wicket Training and Consulting
>>> https://twitter.com/mtgrigorov
>>>
>>>
>>
--
Become a Wicket expert, learn from the best: http://wicketinaction.com
Re: CookieUtils multivalued support broken since a while
Posted by Martin Grigorov <mg...@apache.org>.
I'm also in favor to deprecate the multivalue related methods in 6.x and
remove them in 7.x
Martin Grigorov
Wicket Training and Consulting
https://twitter.com/mtgrigorov
On Fri, Jul 25, 2014 at 3:09 PM, Sven Meier <sv...@meiers.net> wrote:
> [+1] deprecated them and remove in Wicket 7.x/8.x ?
>
> Remove them and anything related to multi-valued cookies too.
>
> Regards
> Sven
>
>
>
>
> On 07/23/2014 04:31 PM, Martin Grigorov wrote:
>
>> Hi,
>>
>> At https://issues.apache.org/jira/browse/WICKET-5648 we identified that
>> the
>> support for a cookie with several values is broken.
>> CookieUtils uses FormComponent#VALUE_SEPARATOR to separate the values.
>> The problem is that VALUE_SEPARATOR is ";" - a semicolon is not allowed
>> neither in the value nor the name. It is actually used as a separator
>> between the key/value pairs.
>>
>> The question is how to fix this ?
>>
>> The reporter suggested to use URL encoding for the values.
>> https://developer.mozilla.org/en-US/docs/Web/API/document.cookie also
>> suggests the same.
>> The problem is that this is a behavior change - an application may use
>> values with '/', for example, and read them in JS. If we apply URL
>> encoding
>> then the app will break. To fix it it will have to use
>> decodeURIComponent(theValue) at the client side.
>> Since no one complained about the broken value separator for the last 7
>> years I suggest to leave like it is now and fix it only in Wicket 7.x.
>>
>> Other ideas ?
>>
>> Additionally CookieUtils provide save() and load() methods that work with
>> FormComponent. I guess they have been used for the IValuePersister impls
>> in
>> Wicket 1.3.x. At the moment Wicket doesn't use them. The only usage is in
>> the unit tests.
>> Should we keep them around or deprecated them and remove in Wicket
>> 7.x/8.x ?
>>
>>
>> Martin Grigorov
>> Wicket Training and Consulting
>> https://twitter.com/mtgrigorov
>>
>>
>
Re: CookieUtils multivalued support broken since a while
Posted by Sven Meier <sv...@meiers.net>.
[+1] deprecated them and remove in Wicket 7.x/8.x ?
Remove them and anything related to multi-valued cookies too.
Regards
Sven
On 07/23/2014 04:31 PM, Martin Grigorov wrote:
> Hi,
>
> At https://issues.apache.org/jira/browse/WICKET-5648 we identified that the
> support for a cookie with several values is broken.
> CookieUtils uses FormComponent#VALUE_SEPARATOR to separate the values.
> The problem is that VALUE_SEPARATOR is ";" - a semicolon is not allowed
> neither in the value nor the name. It is actually used as a separator
> between the key/value pairs.
>
> The question is how to fix this ?
>
> The reporter suggested to use URL encoding for the values.
> https://developer.mozilla.org/en-US/docs/Web/API/document.cookie also
> suggests the same.
> The problem is that this is a behavior change - an application may use
> values with '/', for example, and read them in JS. If we apply URL encoding
> then the app will break. To fix it it will have to use
> decodeURIComponent(theValue) at the client side.
> Since no one complained about the broken value separator for the last 7
> years I suggest to leave like it is now and fix it only in Wicket 7.x.
>
> Other ideas ?
>
> Additionally CookieUtils provide save() and load() methods that work with
> FormComponent. I guess they have been used for the IValuePersister impls in
> Wicket 1.3.x. At the moment Wicket doesn't use them. The only usage is in
> the unit tests.
> Should we keep them around or deprecated them and remove in Wicket 7.x/8.x ?
>
>
> Martin Grigorov
> Wicket Training and Consulting
> https://twitter.com/mtgrigorov
>