Details
-
Bug
-
Resolution: Done
-
Not Evaluated
-
4.8.0
-
None
-
8ba781b01e900148fec2e9d26485369b3295487f
Description
Other browsers allow commas in cookie values sent by HTTP servers, this cause incompatibilities with our cookie parsing implementation which strictly follows the standard and interprets commas in a cookie value as delimiter for a next cookie.
RFC6265 recently clarified the behavior informally adopted by user agents over the last RFC and states that semicolons should be used to separate cookies and that "origin servers SHOULD NOT fold multiple Set-Cookie header fields into a single header field.".