3 ms·

I URL-Encode it: var res = opt.encode(key) + '=' + encoded + ... Where `opt.encode()` is defined as: function (val) { return encodeURIComponent

I URL-Encode it: var res = opt.encode(key) + '=' + encoded + ... Where `opt.encode()` is defined as: function (val) { return encodeURIComponent(val); } But from your comment I understand that this is not enough and I should dig deeper into this (though I find the RFC really dense/difficult to read).

niftich 10y ago
I did more research and have a further follow-up. According to MDN [1], encodeURIComponent escapes all characters except the following: alphabetic, decimal digits, - _ . ! ~ * ' ( ) which means that out of the allowed ASCII characters in a cookie name: "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." / "^" / "_" / "`" / "|" / "~" / DIGIT (0-9) / ALPHA (A-Z, a-z) the following matrix of behaviors results: Gets-Encoded? Is-Allowed? Current-Behavior ----------------------------------------------------- ! not-encoded allowed behavior-OK # encoded allowed unnecessarily-encoded $ encoded allowed unnecessarily-encoded % encoded allowed unnecessarily-encoded & encoded allowed unnecessarily-encoded ' not-encoded allowed behavior-OK * not-encoded allowed behavior-OK + encoded allowed unnecessarily-encoded - not-encoded allowed behavior-OK . not-encoded allowed behavior-OK ^ encoded allowed unnecessarily-encoded _ not-encoded allowed behavior-OK ` encoded allowed unnecessarily-encoded | encoded allowed unnecessarily-encoded ~ not-encoded allowed unnecessarily-encoded ( not-encoded not-allowed invalid-must-encode ) not-encoded not-allowed invalid-must-encode [1] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/encodeURIComponent https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

niftich 10y ago

I did more research and have a further follow-up. According to MDN [1], encodeURIComponent escapes all characters except the following: alphabetic, decimal digits, - _ . ! ~ * ' ( ) which means that out of the allowed ASCII characters in a cookie name: "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." / "^" / "_" / "`" / "|" / "~" / DIGIT (0-9) / ALPHA (A-Z, a-z) the following matrix of behaviors results: Gets-Encoded? Is-Allowed? Current-Behavior ----------------------------------------------------- ! not-encoded allowed behavior-OK # encoded allowed unnecessarily-encoded $ encoded allowed unnecessarily-encoded % encoded allowed unnecessarily-encoded & encoded allowed unnecessarily-encoded ' not-encoded allowed behavior-OK * not-encoded allowed behavior-OK + encoded allowed unnecessarily-encoded - not-encoded allowed behavior-OK . not-encoded allowed behavior-OK ^ encoded allowed unnecessarily-encoded _ not-encoded allowed behavior-OK ` encoded allowed unnecessarily-encoded | encoded allowed unnecessarily-encoded ~ not-encoded allowed unnecessarily-encoded ( not-encoded not-allowed invalid-must-encode ) not-encoded not-allowed invalid-must-encode [1] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/encodeURIComponent https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...