14

In some web server, cookie with a comma in value will be split into two cookie (one with empty value). For example, "foo=bar,goo" will be treated just like "foo=bar;goo=". Is this right according to RFC?

I find this RFC document but don't know exactly what it means.

cookie-pair       = cookie-name "=" cookie-value
cookie-name       = token
cookie-value      = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
cookie-octet      = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
                   ; US-ASCII characters excluding CTLs,
                   ; whitespace DQUOTE, comma, semicolon,
                   ; and backslash

RFC 6265

4 Answers 4

9

NO they are not allowed.

From the specs:

This string is a sequence of characters excluding semi-colon, comma and white space.

The same can be checked in RFC2965 and RFC2616

3
  • Thank you, but it is valid in platforms like PHP.
    – leetom
    Aug 19, 2014 at 16:11
  • 1
    @leetom Protocol specifications are software independent. There is no functionality in PHP to ensure validity of HTTP response header fields.
    – Daniel W.
    Aug 19, 2014 at 16:15
  • 2
    Then those platforms are violating the specs. Aug 19, 2014 at 16:15
8
cookie-pair       = cookie-name "=" cookie-value
cookie-name       = token
cookie-value      = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
cookie-octet      = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
                   ; US-ASCII characters excluding CTLs,
                   ; whitespace DQUOTE, comma, semicolon,
                   ; and backslash

What are those keywords: cookie-pair, cookie-name, cookie-value, cookie-octet?

cookie-value is the right-side part of =.

cookie-octet is the real value, enclosed in double quotes or nothing. See:

key="value"

or

key=value

When you put in a , (or ;) see what happens:

key="value,",key2="value2"

or

key=value,,key2=value2

So, your assumption is not quite correct and you must not use comma or semicolon inside the value.

4
  • Thank you. The web server I tested may be too "modern", while other platforms like PHP still allow comma as a valid value.
    – leetom
    Aug 19, 2014 at 16:10
  • You must test it with clients, not with servers. It's for (backwards)compatibility for clients and interoperability between RFCs. From the servers perspective, you should never work with tricks to insert a second value, declare it properly.
    – Daniel W.
    Aug 19, 2014 at 16:13
  • Thank you again! But I like your old answer. :) I only wonder what the star near cookie-octet means.
    – leetom
    Aug 19, 2014 at 16:27
  • @leetom I think the * means, that the value can be empty
    – Daniel W.
    Aug 19, 2014 at 16:33
3

According to the document's part you quoted, commas are not allowed:

US-ASCII characters excluding CTLs, whitespace DQUOTE, comma, semicolon, and backslash

However, I believe all modern browsers allow it anyway so use it at your risk. You can always use base64 or something similar depending on your goal if you need to encode special characters and stay compliant.

3
  • But semicolon is also allowed according to the document, which is obviously wrong. So I wonder what does this mean.
    – leetom
    Aug 19, 2014 at 15:59
  • Sorry I made a mistake. It's excluding these characters.
    – leetom
    Aug 19, 2014 at 16:02
  • RFC 6265 was specifically written to consolidate the existing cookie RFCs of the time and clarify their rules based on existing real-world usage. That includes the grammar. So no, commas are not allowed in cookie values, and no browsers actually implemented that. Aug 19, 2014 at 16:14
0

The 6265 RFC spec and other similar specs are using the ABNF grammar:

cookie-octet      = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
                   ; US-ASCII characters excluding CTLs,
                   ; whitespace DQUOTE, comma, semicolon,
                   ; and backslash

Lines that start with ; are comments. They are helpful but have no grammatical meaning.

The slashes / separate alternatives.

Literal characters and ranges are specified using their octal representation:

%x21 is !
%x23-2B encompass the characters # $ % & ' ( ) * +
%x2D-3A encompass the characters - . / 0-9 :
%x3C-5B encompass the characters < = > ? @ A-Z [
%x5D-7E encompass the characters ] ^ _ ` a-z { | } ~

The comma code 0x2C isn't included in any of the ranges, which makes it an invalid character to use in a cookie-octet or a cookie-value.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.