Is comma a valid character in cookie-value

Question

In some web server, cookie with a comma in value will be split into two cookie (one with empty value). For example, "foo=bar,goo" will be treated just like "foo=bar;goo=". Is this right according to RFC?

I find this RFC document but don't know exactly what it means.

cookie-pair       = cookie-name "=" cookie-value
cookie-name       = token
cookie-value      = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
cookie-octet      = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
                   ; US-ASCII characters excluding CTLs,
                   ; whitespace DQUOTE, comma, semicolon,
                   ; and backslash

RFC 6265

Answer 1

cookie-pair       = cookie-name "=" cookie-value
cookie-name       = token
cookie-value      = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
cookie-octet      = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
                   ; US-ASCII characters excluding CTLs,
                   ; whitespace DQUOTE, comma, semicolon,
                   ; and backslash

What are those keywords: cookie-pair, cookie-name, cookie-value, cookie-octet?

cookie-value is the right-side part of =.

cookie-octet is the real value, enclosed in double quotes or nothing. See:

key="value"

or

key=value

When you put in a , (or ;) see what happens:

key="value,",key2="value2"

or

key=value,,key2=value2

So, your assumption is not quite correct and you must not use comma or semicolon inside the value.