Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

In HTTP specification, what is the string that separates cookies?

Tags:

Semicolon ;, the Cookie: string or some other string?

like image 673
lovespring Avatar asked Jan 30 '11 15:01

lovespring


People also ask

How are cookies separated?

Each cookie is separated by a comma , and each cookie attributes are separated by semicolons ; . The two values required are the first name=value pair which are always string values.

What HTTP part include cookies?

The Cookie HTTP request header contains stored HTTP cookies associated with the server (i.e. previously sent by the server with the Set-Cookie header or set in JavaScript using Document. cookie ). The Cookie header is optional and may be omitted if, for example, the browser's privacy settings block cookies.

What header line in HTTP response message is used for cookies?

The Set-Cookie HTTP response header is used to send a cookie from the server to the user agent, so that the user agent can send it back to the server later.

Where are cookies stored in HTTP?

The cookie file is stored in the user's browser application data folder. Later, the browser automatically sends this cookie as part of the request.


2 Answers

Inspecting cookies in an HTTP request

The Cookie: header has the following syntax:

Cookie: <Name> = <Value> { ; <Name> = <Value> }

Hence individual cookies are separated with the semicolon and a space.

Setting cookies in an HTTP response

On the other hand, when setting a cookie in the response, there one cookie per the Set-Cookie: header:

Set-Cookie: <Name> = <Value> [ ; expires = <Date>] [ ; path = <Path> ] [ ; domain = <Domain> ] // etc…

To set multiple cookies the Set-Cookie header is repeated in an HTTP response.


Notes:

  • Have a look here for a tutorial with examples, and to RFC 6265 HTTP State Management Mechanism for a normative reference showing the full details of the syntax.
  • The now-obsolete RFC 2965 defined an alternate pair of headers Cookie2 and Set-Cookie2 which were abandoned.
  • The obsoleted versions of the HTTP State Management Mechanism (RFC 2109 and RFC 2965) provided a way to fold multiple Set-Cookie (or Set-Cookie2) headers into one. However, this folding is not recommended by the latest RFC 6265 spec.
like image 153
Ondrej Tucny Avatar answered Sep 20 '22 11:09

Ondrej Tucny


The answer is a comma , sign.

In section 4.2.2 of RFC 2109 there's this specification of Set-Cookie header

   set-cookie      =       "Set-Cookie:" cookies
   cookies         =       1#cookie

with the following statement Informally, the Set-Cookie response header comprises the token Set-Cookie:, followed by a comma separated list of one or more cookies. (Formally meaning of # in the above notation is defined in RFC 733 in section A. NOTATIONAL CONVENTIONS, point 5

A construct "#" is defined, similar to "*", as follows:

              <l>#<m>element

indicating at least <l> and at most <m> elements, each separated by one or more commas (",").

Yes, RFC 2109 was obsoleted by RFC 2965, which in turn was obsoleted by RFC 6265.
No, it doesn't change anything in this context as

  • most existing HTTP servers and clients support RFC 2109
  • RFC 6265 does not forbid Set-Cookie folding
like image 22
Piotr Dobrogost Avatar answered Sep 21 '22 11:09

Piotr Dobrogost