Subject: Set-Cookie and commas in extension attributes

From: "Martin Thomson" <[email-masked]>
Date: Fri, 15 Jan 2021 16:47:09 +1100

Just confirming this, but it appears as though comma is a valid character in an extension to Set-Cookie.  What happens if an intermediary combines two Set-Cookie header fields as permitted by the core specification[1]?

[1] https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#field.lines

---

From: Nick Harper <[email-masked]>
Date: Thu, 14 Jan 2021 22:01:25 -0800

I would imagine that the recipient would only parse the first cookie in the
header and the remainder would be treated as unknown extensions and
ignored. The following section has a note calling out Set-Cookie and that
multiple field lines shouldn’t be combined into one for that particular
header.

On Thu, Jan 14, 2021 at 9:50 PM Martin Thomson <[email-masked]> wrote:

> Just confirming this, but it appears as though comma is a valid character
> in an extension to Set-Cookie.  What happens if an intermediary combines
> two Set-Cookie header fields as permitted by the core specification[1]?
>
> [1]
> https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#field.lines
>
>

---

From: "Martin Thomson" <[email-masked]>
Date: Fri, 15 Jan 2021 17:15:25 +1100

On Fri, Jan 15, 2021, at 17:01, Nick Harper wrote:
> I would imagine that the recipient would only parse the first cookie in 
> the header and the remainder would be treated as unknown extensions and 
> ignored. The following section has a note calling out Set-Cookie and 
> that multiple field lines shouldn’t be combined into one for that 
> particular header.

I couldn't find that.  There are several sections that talk about Set-Cookie.  No mention of field lines or combined values either that my searching threw out.

In any case, I don't think that you get to say "don't do that" here.  Saying "stuff breaks if this has happened" is perhaps as far as you get to go.

---

From: Julian Reschke <[email-masked]>
Date: Fri, 15 Jan 2021 07:33:51 +0100

> [1] https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#field.lines

The core specs already say not do that, but maybe rfc6265bis should
point that out as well.

Best regards, Julian