Semicolon ;
, the Cookie:
string or some other string?
2 Answers
Inspecting cookies in an HTTP request
The Cookie:
header has the following syntax:
Cookie: <Name> = <Value> { ; <Name> = <Value> }
Hence individual cookies are separated with the semicolon and a space.
Setting cookies in an HTTP response
On the other hand, when setting a cookie in the response, there one cookie per the Set-Cookie:
header:
Set-Cookie: <Name> = <Value> [ ; expires = <Date>] [ ; path = <Path> ] [ ; domain = <Domain> ] // etc…
To set multiple cookies the Set-Cookie
header is repeated in an HTTP response.
Notes:
- Have a look here for a tutorial with examples, and to RFC 6265 HTTP State Management Mechanism for a normative reference showing the full details of the syntax.
- The now-obsolete RFC 2965 defined an alternate pair of headers
Cookie2
andSet-Cookie2
which were abandoned. - The obsoleted versions of the HTTP State Management Mechanism (RFC 2109 and RFC 2965) provided a way to fold multiple
Set-Cookie
(orSet-Cookie2
) headers into one. However, this folding is not recommended by the latest RFC 6265 spec.
-
1On the other hand, when setting a cookie in the response, there one cookie per the
Set-Cookie:
header: Not true. In section 4.2.1 of RFC 2109 one reads An origin server may include multiple Set-Cookie headers in a response. Note that an intervening gateway could fold multiple such headers into a single header. In section 4.2.2 of the same RFC one reads Informally, the Set-Cookie response header comprises the token Set-Cookie:, followed by a comma separated list of one or more cookies. Commented Nov 24, 2011 at 20:25 -
@PiotrDobrogost RFC 2109 was obsoleted by RFC 2965, which in turn was obsoleted by RFC 6265. The latest spec recommends avoiding
Set-Cookie
folding. Both 2109 and 2965 do not support folding in the presented ABNF syntax. Thanks for pointing out this ambiguity. I will fix the RFC reference in my response. Commented Nov 24, 2011 at 21:23 -
Both 2109 and 2965 do not support folding in the presented ABNF syntax. Not true Presented ABNF syntax clearly supports multiple cookies in one
Set-Cookie
header (folding) - see my answer. Commented Nov 25, 2011 at 11:30 -
2Hence individual cookies are separated with the semicolon. Not true. The semicolon in the syntax of
Cookie:
header you present separates each<Name>=<Value>
pair not each cookie as each cookie can have any number of such pairs. Commented Mar 14, 2013 at 10:10 -
1"separated with the semicolon" - Although, they are actually separated by semicolon + space (2 chars). developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cookie– MrWhiteCommented Nov 8, 2020 at 13:38
The answer is a comma ,
sign.
In section 4.2.2 of RFC 2109 there's this specification of Set-Cookie
header
set-cookie = "Set-Cookie:" cookies
cookies = 1#cookie
with the following statement Informally, the Set-Cookie response header comprises the token Set-Cookie:, followed by a comma separated list of one or more cookies. (Formally meaning of #
in the above notation is defined in RFC 733 in section A. NOTATIONAL CONVENTIONS, point 5
A construct "#" is defined, similar to "*", as follows:
<l>#<m>element
indicating at least
<l>
and at most<m>
elements, each separated by one or more commas (",").
Yes, RFC 2109 was obsoleted by RFC 2965, which in turn was obsoleted by RFC 6265.
No, it doesn't change anything in this context as
- most existing HTTP servers and clients support RFC 2109
- RFC 6265 does not forbid
Set-Cookie
folding
-
1It matters a lot. RFC 6265 is supposed to describe what UAs actually do. Commented Nov 25, 2011 at 9:29
-
@JulianReschke Well in this case could you please tell us which of popular UAs do not handle folded
Set-Cookie
header? Commented Nov 25, 2011 at 10:09 -
Piotr, I have no idea, and I don't have said so. I was just pointing out that RFC 6265 is supposed to accurately define how cookies work, as opposed to the older RFCs. Commented Nov 27, 2011 at 21:55
-
4-1 because this answer directly contradicts the accepted answer, and the author of this answer even admits that it's not a comma in the comments thread of the accepted answer. Shouldn't this be answer be removed altogether?? Commented Feb 11, 2016 at 11:46
-
RFC 6265 doesn't forbid Set-Cookie folding (probably for backward compatibility), but it discourages it in the strongest terms using "SHOULD NOT": "Origin servers SHOULD NOT fold multiple Set-Cookie header fields into a single header field." Commented Oct 3, 2017 at 22:17