Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upGitHub is where the world builds software
Millions of developers and companies build, ship, and maintain their software on GitHub — the largest and most advanced development platform in the world.
Treat first name/value pair in Set-Cookie: as the cookie name [RFC compliance] #709
Labels
Comments
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
RFC 6265 section 4.1.1 spells out that the first name/value pair in the header is the actual cookie name and content, while the following are the parameters.
libcurl currently has a more liberal approach which causes significant problems when introducing new cookie parameters, like the suggested new cookie priority draft.
The current parser gets all n/v pairs and the first name isn't a known parameter will be considered the cookie, thus accepting
Set-Cookie: Max-Age=2; name=danielwhile an RFC compliant parser should consider that to be a cookie named 'Max-Age'.