Search code examples
httpcookiesstandardsspecificationsrfc

Are commas allowed in the cookie value. Unclear specs


From the specs:

cookie-value      = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )  cookie-octet      = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
                       ; US-ASCII characters excluding CTLs,
                       ; whitespace DQUOTE, comma, semicolon,
                       ; and backslash

Can you please help me interpret this? I am not sure if they mean the cookie value can contain comma or the other way around (can't contain comma).

This is important plz.


Solution

  • cookie-pair       = cookie-name "=" cookie-value
    cookie-name       = token
    cookie-value      = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
    cookie-octet      = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
                          ; US-ASCII characters excluding CTLs,
                          ; whitespace DQUOTE, comma, semicolon,
                          ; and backslash
    

    So, according to the ABNF, the value can not contain a comma.