The age and expiration date should be unsigned long, not just
long.

For some reason a strcmp() was used where a case-insensitive search should
be used. This was further hidden by the fact that SoupMessageHeaders interns
the name of headers, so the first time a header is seen by the library will
be the casing that is used, rendering the case-insensitivity test useless.

Fix the string comparison and move the test for sensitivity to the top so that
it runs first and the interned STS header name is the allcaps one that will
allow the test to work.

Using %d for values that are actually unsigned causes problems,
in particular with servers using a rather large max-age.

Added a test that reproduces the issue.

After working on the HSTS feature for WebKit it became obvious
that relying on the SoupMessage::uri property changes is far from
ideal. So let's add a signal that will be emitted whenever the
enforcer does its thing wih a SoupMessage.

We should try find_library() before fallback to subproject, for
platforms that does not ship the .pc file.

Also the return value of cc.has_header() is currently not used, those
statements have no effect. Fix this by using has_headers kwarg of
find_library(), a new syntax from Meson 0.50.0. We want to find the
library AND its headers, or fallback to subproject.

There are some edge cases that can be hit by the brotli decoder.

This will be resolved in the future but for now just function.

The specification requires hostnames to be canonicalized before they
are processed by clients. Do this, add a comment about it to the
documentation, and add a couple of tests that mix ASCII-encoded
hostnames and IDNA-canonicalized ones.

The specification requires that STS known hosts have their messages
cancelled if there are any underlying secure transport errors.

Use the recently added strict parameter parsing method to check
for duplicate directives and ignore them, as per the specification.
Uncomment the duplicate directives test.

I can't see a reason for it to be private, and it's needed for unit
testing.

Ensure that the multiple-headers test checks that only the first
one is honored and the second one ignored.

This test is commented out because the implementation will
not ignore headers with duplicated parameters.

This is a comprehensive rework of the HSTS enforcer and related
classes, based upon Adrien Plazas work. A summary of the most
relevant changes:

SoupHSTSEnforcer:

- The enforcer will listen on headers both on message queueing
  and restarting. This is necessary in order to be able to enforce
  HSTS redirections on messages that are restarted for whatever
  reason.
- Instead of causing a redirection, the URI will be overwritten
  directly on the message before it is sent. Redirections
  are for use on the server side, and the tests added show that
  it is not a reliable way to do HSTS enforcing. Currently,
  the only way to find out that a HSTS policy has been enforced
  is by listening to the SoupMessage:uri property changes, but
  this might be impractical, so this could be revisited in the
  future.
- soup_hsts_enforcer_policy() will not steal the given policy.
  Doing so is prone to leaks and not customary.
- SoupHSTSEnforcerClass now has a has_valid_policy() vfunc.
  It currently works exactly as before, but the idea here is to
  make it possible for subclasses to implement their own check
  for existence of valid policies for domains, instead of all
  subclasses having to add their policies to the base
  SoupHSTSEnforcer class. This will be useful when having a large
  number of pre-loaded HSTS policies (either in SoupHSTSEnforcerDB
  or in an enforcer using libhsts as a backend) to avoid having
  potentially thousands of policies in memory at all times.
- HSTS headers are parsed using soup's available utilities,
  instead of parsing them by hand. The specification is carefully
  followed so as to not accept any header that is not fully
  compliant.

SoupHSTSEnforcerDB:

- Store the max-age attribute in the database. This was done before
  errata 5372 was reported to RFC 6797, and its necessity will
  depend on how the errata is treated.

Other:

- Added tests for both enforcer classes that cover most of the
  specification.
- Added the gtk-doc documentation and update all the documentation
  comments.
- Rename SoupHsts classes to SoupHSTS for consistent naming and
  other minor renaming of parameters and methods.

This is a WIP.

Add the SoupSessionFeature SoupHstsEnforcer to allow a session to
support HSTS (RFC 6797).

This also adds SoupHstsPolicy and an early version of
SoupHstsEnforcerDb.

This prevents insecure origins from creating or modifying secure cookies.

https://tools.ietf.org/html/draft-ietf-httpbis-cookie-alone-01

v2 is now based on Fedora 30 and includes brotli-devel

This prevents all documentation to be indexed under S in the index.

Use include_directories() instead of hardcoding it to make sure
that both its source and build directory are included.

Forgot to change it in meson_options.txt

This is the standard in GNOME currently.

meson does not allow compile with internal dependency (i.e., fallback dependency)

Currently the tests are failing to build with "undefined reference to
`_imp__htonl@4'". The fix is to add the platform_deps to tests
dependencies. Do that by adding it to the libsoup_dep thus all the
targets are fixed.

!60

Visual Studio 2019 handle it as an error.

FAILED: subprojects/libsoup/libsoup/1b29d39@@soup-2.4@sha/meson-generated_.._soup-enum-types.c.obj
cl @subprojects/libsoup/libsoup/1b29d39@@soup-2.4@sha/meson-generated_.._soup-enum-types.c.obj.rsp
subprojects\glib\glib/gmacros.h(824): error C4819:
    The file contains a character that cannot be represented in the current code page (949).
    Save the file in Unicode format to prevent data loss

gettext might not be available on Windows