Re: RFC 6265: Nameless cookies use-cases

On Thu, 25 Jun 2026 at 22:40, Xyan Bhatnagar <xyanb@apple.com> wrote:

> Hi all,
>
> We've been looking at RFC6265bis draft for guidance on nameless cookies.
>
> We see that RFC6265bis says that "servers MUST NOT produce nameless
> cookies (i.e.: an empty cookie-name) as such cookies may be unpredictably
> serialized by UAs when sent back to the server.” (Section 4.1.1)
>
> The RFC does not prohibit clients from accepting them. Section 5.6
> explicitly says that the name may be “possibly empty"
>
> Safari has rejected nameless cookies for a while now. What are the
> observed use-cases of nameless cookies? Does anyone know of servers that
> send out such cookies and the motivations for doing so?
>
>
Hi Xyan,

I'll just note that Firefox also used to support nameless cookies until
recently, but we changed that in
https://bugzilla.mozilla.org/show_bug.cgi?id=2026913
Nameless cookies have always been a problematic edge-case for us, so we
decided to align with Safari instead of Chrome.
Another argument against nameless cookies was:
> Squarcina's "Cookie Crumbles"
https://www.usenix.org/system/files/usenixsecurity23-squarcina.pdf#page=10,
from page 10, there's a table about analyzing nameless cookies in top 100K
websites. From that analysis, nameless cookies are very rare and seem like
a configuration mistake almost always (TOP 4: nameless cookies with the
values HttpOnly, (empty string), Secure and =).

So while theoretically we might still "accept" nameless cookies coming from
the server (and send them back in the same format), in practice I think
it's easiest not to allow them. So far I am not aware of a use case for
nameless cookies.

Thanks!