diff --git a/draft-ietf-httpbis-rfc6265bis.md b/draft-ietf-httpbis-rfc6265bis.md index 21003dcbd..52ec15d95 100644 --- a/draft-ietf-httpbis-rfc6265bis.md +++ b/draft-ietf-httpbis-rfc6265bis.md @@ -349,11 +349,20 @@ origin server can include multiple Set-Cookie header fields in a single response The presence of a Cookie or a Set-Cookie header field does not preclude HTTP caches from storing and reusing a response. -Origin servers MUST NOT fold multiple Set-Cookie header fields into a single -header field. The usual mechanism for folding HTTP headers fields (i.e., as -defined in {{Section 5.3 of RFC9110}}) might change the semantics of the Set-Cookie header -field because the %x2C (",") character is used by Set-Cookie in a way that -conflicts with such folding. +Origin servers and intermediaries MUST NOT combine multiple Set-Cookie header +fields into a single header field. The usual mechanism for combining HTTP +headers fields (i.e., as defined in {{Section 5.3 of RFC9110}}) might change +the semantics of the Set-Cookie header field because the %x2C (",") character +is used by Set-Cookie in a way that conflicts with such combining. + +For example, + +~~~ +Set-Cookie: a=b;path=/c,d=e +~~~ + +is ambiguous. It could be intended as two cookies, a=b and d=e, or a single +cookie with a path of /c,d=e. User agents MAY ignore Set-Cookie header fields based on response status codes or the user agent's cookie policy (see {{ignoring-cookies}}).