Re: Set-Cookie and commas in extension attributes

I would imagine that the recipient would only parse the first cookie in the
header and the remainder would be treated as unknown extensions and
ignored. The following section has a note calling out Set-Cookie and that
multiple field lines shouldn’t be combined into one for that particular
header.

On Thu, Jan 14, 2021 at 9:50 PM Martin Thomson <mt@lowentropy.net> wrote:

> Just confirming this, but it appears as though comma is a valid character
> in an extension to Set-Cookie.  What happens if an intermediary combines
> two Set-Cookie header fields as permitted by the core specification[1]?
>
> [1]
> https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#field.lines
>
>