mnot / I-D

My Internet-Drafts
https://mnot.github.io/I-D/
Other
98 stars 38 forks source link

Cookie-Indices should specify how duplicate cookies are treated #347

Closed jeremyroman closed 3 months ago

jeremyroman commented 3 months ago

It is possible for two cookies with the same name to be presented in a request (for example, because they have different paths, both of which match the request URI). However, the algorithm refers to "the value of the cookie with the name", which is not well-defined if there are multiple such cookies.

For example, Cookie: foo=baz; foo=bar is a valid request header field that implementations (Chromium, at least) can and do send.

I think what these values should be treated as an unordered list (i.e., they are equivalent if the values present for each cookie are the same, and the number of times each is present is also the same). This is analogous to how the order of cookies of with distinct names can be reordered at present.