4 ms·

Firefox accepts five characters which RFC recommends that servers not send: 0x09 (horizontal tab) 0x20 (spaces) 0x22 (double quotes) 0x2C (comm

• remram 2y ago
  Quotes in the value when quotes delimit the value? Yeah that seems dangerous to me.
  • anamexis 2y ago
    Quotes don't delimit the value.
    • pimlottc 2y ago
      Per the section 4.1.1 rules quoted in the article, cookie values can be optionally quoted: > cookie-value = cookie-octet / ( DQUOTE cookie-octet DQUOTE )
      • anamexis 2y ago
        That is true, but in that case they are part of the value itself, they're not doing anything special: > Per the grammar above, the cookie-value MAY be wrapped in DQUOTE characters. Note that in this case, the initial and trailing DQUOTE characters are not stripped. They are part of the cookie-value, and will be included in Cookie header fields sent to the server.
        • pimlottc 2y ago
          Ah, thanks for the clarification!
        • kangalioo 2y ago
          Why does the specification specifically mention them, then?
          • anamexis 2y ago
            To clarify that by the spec, double quotes are allowed in the cookie value, but only at the beginning and end. As for why that is, I have no idea.
• deleted 2y ago
  [deleted]