Search code examples
httpcookies

Do HTTP cookies have to have a value?

Can you have a HTTP cookie without a value?

ALLTHINGSGOOD=

The spec says without a name, it should be ignored.

  1. If the name string is empty, ignore the set-cookie-string entirely.

But it doesn't seem to touch on what do without a value.

Solution

  • Sure, empty string is a valid value. The spec says,

    1. The (possibly empty) name string consists of the characters up to, but not including, the first %x3D ("=") character, and the (possibly empty) value string consists of the characters after the first %x3D ("=") character.

    Practically, I would still set some kind of dummy value like "0" to avoid potential edge case bugs in some exotic browsers.