Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Errata fix #2991

Merged
merged 7 commits into from
Feb 14, 2025
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 14 additions & 5 deletions draft-ietf-httpbis-rfc6265bis.md
Original file line number Diff line number Diff line change
Expand Up @@ -349,11 +349,20 @@ origin server can include multiple Set-Cookie header fields in a single response
The presence of a Cookie or a Set-Cookie header field does not preclude HTTP
caches from storing and reusing a response.

Origin servers MUST NOT fold multiple Set-Cookie header fields into a single
header field. The usual mechanism for folding HTTP headers fields (i.e., as
defined in {{Section 5.3 of RFC9110}}) might change the semantics of the Set-Cookie header
field because the %x2C (",") character is used by Set-Cookie in a way that
conflicts with such folding.
Origin servers and intermediaries MUST NOT combine multiple Set-Cookie header
fields into a single header field. The usual mechanism for combining HTTP
headers fields (i.e., as defined in {{Section 5.3 of RFC9110}}) might change
the semantics of the Set-Cookie header field because the %x2C (",") character
is used by Set-Cookie in a way that conflicts with such combining.

For example,

~~~
Set-Cookie: a=b;path=/c,d=e
~~~

is ambiguous. It could be intended as two cookies, a=b and d=e, or a single
cookie with a path of /c,d=e.

User agents MAY ignore Set-Cookie header fields based on response status codes or
the user agent's cookie policy (see {{ignoring-cookies}}).
Expand Down