4 ms·

Quotes in the value when quotes delimit the value? Yeah that seems dangerous to me.

• anamexis 2y ago
  Quotes don't delimit the value.
  • pimlottc 2y ago
    Per the section 4.1.1 rules quoted in the article, cookie values can be optionally quoted: > cookie-value = cookie-octet / ( DQUOTE cookie-octet DQUOTE )
    • anamexis 2y ago
      That is true, but in that case they are part of the value itself, they're not doing anything special: > Per the grammar above, the cookie-value MAY be wrapped in DQUOTE characters. Note that in this case, the initial and trailing DQUOTE characters are not stripped. They are part of the cookie-value, and will be included in Cookie header fields sent to the server.
      • pimlottc 2y ago
        Ah, thanks for the clarification!
      • kangalioo 2y ago
        Why does the specification specifically mention them, then?
        • anamexis 2y ago
          To clarify that by the spec, double quotes are allowed in the cookie value, but only at the beginning and end. As for why that is, I have no idea.