Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disallow setting cookie names that contain '=' #201

Open
recvfrom opened this issue Aug 6, 2021 · 0 comments
Open

Disallow setting cookie names that contain '=' #201

recvfrom opened this issue Aug 6, 2021 · 0 comments

Comments

@recvfrom
Copy link
Contributor

recvfrom commented Aug 6, 2021

I think we should add the following to the Set a Cookie section:

1. If |name| contains U+003D (`=`), then return failure.

Otherwise, a cookie with a name containing = will be incorrectly parsed by the server, which I think is more of a bug than a feature. RFC6265bis doesn't explicitly forbid this right now (this case is only possible for cookies not constructed by parsing a cookie line), but I've opened a ticket there for this as well - httpwg/http-extensions#1593

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant