Hacker News Reader

Comment by hinkley | Hacker News Reader

    Firefox accepts five characters which RFC recommends that servers not send:

    0x09 (horizontal tab)
    0x20 (spaces)
    0x22 (double quotes)
    0x2C (commas)
    0x5C (backslashes)

I agree with at least some of these. Cookies without commas? Quotes?

View on HN

Quotes in the value when quotes delimit the value? Yeah that seems dangerous to me.

Quotes don't delimit the value.

Per the section 4.1.1 rules quoted in the article, cookie values can be optionally quoted:

> cookie-value = cookie-octet / ( DQUOTE cookie-octet DQUOTE )

That is true, but in that case they are part of the value itself, they're not doing anything special:

> Per the grammar above, the cookie-value MAY be wrapped in DQUOTE characters. Note that in this case, the initial and trailing DQUOTE characters are not stripped. They are part of the cookie-value, and will be included in Cookie header fields sent to the server.

Ah, thanks for the clarification!

Why does the specification specifically mention them, then?

To clarify that by the spec, double quotes are allowed in the cookie value, but only at the beginning and end.

As for why that is, I have no idea.

Reply on news.ycombinator.com