Search code examples
sslcookiesheaderhttp-headerssetcookie

Is this a valid Set-Cookie syntax

I find a Set-Cookie header which I need to know if it is valid syntax or not. 

SessionId=ccc; path=/; HttpOnly, Secure; HttpOnly

My questions mainly are:

1) Is it valid to use comma before the directive Secure?

2) Is the directive Secure always preceded by a cookie value in the form of x=y? I mean the order. Can the directive Secure comes before the equation? or without equation?

I am at loss and either the above header is misconfigured or I am wrong. From my understanding of the Set-Cookie header syntax in Mozilla site here the directive Secure should always be preceded by a semicolon, then space, as in: ; Secure after the word Secure, there can be either a semicolon ; or it is the end of line. Please, clearify, I need accurate answer to write a regexp.

Solution

  • In this RFC document you will find detailed information on the grammar set cookie: https://www.rfc-editor.org/rfc/rfc6265#page-8