Closed Bug 988811 Opened 12 years ago Closed 10 years ago

Cookie values are not quoted if they contain separator characters

Categories

(Core :: Networking: HTTP, defect)

Product:
Core
Component:
Networking: HTTP
Version:
28 Branch
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED INVALID

People

(Reporter: florian, Unassigned)

Details

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:28.0) Gecko/20100101 Firefox/28.0 (Beta/Release) Build ID: 20140317233501 Steps to reproduce: Set a cookie via HTTP Set-Cookie: name=abcde@fghijk;domain=mydomain.com;HttpOnly Actual results: The Cookie is transferred as the following HTTP header Cookie: name=abcde@fghijk Expected results: Cookie: name="abcde@fghijk" Because the cookie value contains the HTTP Header separator character "@" I would expect the cookie value to be quoted. See http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html
See also http://www.rfc-editor.org/rfc/rfc6265.txt That's at least one cookie spec that allows the @ char inside a cookie value, to my understanding.
It seems that Firefox relies on the server sending spec-compliant syntax. In this case it is safe to just mirror the received string completely. Therefore this is not an issue.
Status: UNCONFIRMED → RESOLVED
Closed: 10 years ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.