Re: RFC 6265: Nameless cookies use-cases

On Thu, Jun 25, 2026 at 1:38 PM Xyan Bhatnagar <xyanb@apple.com> wrote:

> Safari has rejected nameless cookies for a while now. What are the
> observed use-cases of nameless cookies? Does anyone know of servers that
> send out such cookies and the motivations for doing so?
>

The main issue faced by the original rfc6265 was that sometimes servers
sent `Set-Cookie: foo` instead of a "foo=value". If a browser didn't return
it, some sites would break so the RFC had to define consistent behavior.
But is plain "foo" a name without a value, or a value without a name? On
the server side it wouldn't matter what the browser thinks as long as it
sends the cookie back, but the difference does have detectable
side-effects.  IMHO "nameless value" is a strange unintuitive choice—surely
the servers that use them don't think that's what it is! They probably use
it as a boolean attribute. Or, it turns out, sometimes the malformed cookie
was a mistake. I think part of the reasoning behind nameless cookies was
that the folks at the time wanted to discourage cookies that weren't
name=value, but since they couldn't stop supporting them for web-compat
reasons, by considering them as nameless values sites could only use ONE of
them.

Some of the above is speculation, but I do remember there were sites that
broke if you rejected cookies that weren't name=value pairs, and some
reason to not do the obvious and treat them as valueless names as Safari
does.

-Dan Veditz