Subject: Re: [http-state] Combined headers

From: Maciej Stachowiak <[email-masked]>
Date: Mon, 14 Dec 2009 20:04:27 -0800

On Nov 25, 2009, at 8:18 AM, Adam Barth wrote:

> On Wed, Nov 25, 2009 at 8:08 AM, Thomas Broyer <[email-masked]>  
> wrote:
>
>> Apache HTTPD at least special-cases Set-Cookie headers and doesn't
>> combine them [8]:
>>    /* The HTTP specification says that it is legal to merge duplicate
>>     * headers into one.  Some browsers that support Cookies don't  
>> like
>>     * merged headers and prefer that each Set-Cookie header is sent
>>     * separately.  Lets humour those browsers by not merging.
>>     * Oh what a pain it is.
>>     */
>> There are unfortunately no mention of which browsers "some  
>> browsers" refers to.
>
> We should test, but I'd bet at least IE and Firefox.

I think Safari will accept comma-merged Set-Cookie headers, because  
when splitting on commas we know how to exclude ones that are part of  
a cookie Expires attribute.

Regards,
Maciej