RFC Question about Cookies and Paths

Question

I am trying to set a session cookie limited to a certain path (e.g. /foo) when a user logs in. The complication is that the login page is on /, but the request is immediately redirected to /foo/something. Something like that:

Inquiry:

POST / HTTP/1.1

username=foo&password=bar

Answer:

HTTP/1.0 302 Found
Location: http://example.com/foo/home
Set-Cookie: session=whatever; path=/foo

However, the corresponding RFC bits I could find ( rfc2109 and rfc2965 ):

To prevent potential breaches of security or privacy, the user agent rejects the cookie (does not save its information) if any of the following is true:

• The value for the Path attribute is not a prefix of the request-URI.

...

cookie, , , , , RFC , .

, , .

RFC?

!

Answer 1

RFC; .

IETF, cookie; , , .

: http://datatracker.ietf.org/doc/draft-ietf-httpstate-cookie/

, , !

Answer 2

, , RFC . , cookie '/foo/home'. , : " '/foo/home', '/'?"

(), '/' '/foo/home', , Location.

, : URL- , ? '/foo', POST '/foo/login' '/' ?