@@ -1219,6 +1219,39 @@ said to "receive a cookie" from the request-uri with name cookie-name,
1219
1219
value cookie-value, and attributes cookie-attribute-list. (See {{storage-model}}
1220
1220
for additional requirements triggered by receiving a cookie.)
1221
1221
1222
+ # ## Syntax {#ua-abnf-syntax}
1223
+
1224
+ Based on the parsing algorithms defined above, the following grammar defines
1225
+ the syntax requirements enforced by user agents when parsing set-cookie-strings :
1226
+
1227
+ ~~~ abnf
1228
+ set-cookie = set-cookie-string
1229
+ set-cookie-string = cookie-pair *( BWS ";" OWS cookie-av)
1230
+ cookie-pair = *1(BWS cookie-name BWS "=") BWS cookie-value BWS
1231
+ ; the sum of the lengths of cookie-name and
1232
+ ; cookie-value must be less than or equal to 4096
1233
+ ; octets.
1234
+
1235
+ cookie-name = *4096(cookie-name-octet)
1236
+ cookie-value = *4096(cookie-value-octet)
1237
+ cookie-name-octet = %x09 / %x20-3A / %x3C / %x3E-7E / %x80-FF
1238
+ ; octets excluding non-whitespace CTLs,
1239
+ ; semicolon, and equals.
1240
+ cookie-value-octet = %x09 / %x20-3A / %x3C-7E / %x80-FF
1241
+ ; octets excluding non-whitespace CTLs and
1242
+ ; semicolon.
1243
+
1244
+ cookie-attr = 1*cookie-name-octet BWS cookie-attr-eq-value BWS
1245
+ cookie-attr-eq-value = "" / ("=" BWS optional-attr-value)
1246
+ ; cookie-attr defines the base syntax for all cookie attributes. More
1247
+ ; specific grammars for each of the recognized attribute names can be
1248
+ ; found in the sections below.
1249
+
1250
+ optional-attr-value = *1024(cookie-value-octet)
1251
+ ignored-attr-eq-value = "" / ("=" BWS ignored-atrr-value)
1252
+ ignored-attr-value = optional-attr-value
1253
+ ~~~
1254
+
1222
1255
# ## The Expires Attribute
1223
1256
1224
1257
If the attribute-name case-insensitively matches the string "Expires", the
@@ -1243,6 +1276,15 @@ user agent MUST process the cookie-av as follows.
1243
1276
6. Append an attribute to the cookie-attribute-list with an attribute-name
1244
1277
of Expires and an attribute-value of expiry-time.
1245
1278
1279
+ Based on the parsing algorithm above, the syntax requirements for the Expires
1280
+ attribute are represented by the grammar below. Expires attributes not
1281
+ conforming to this grammar are ignored.
1282
+
1283
+ ~~~ abnf
1284
+ expires-av = "Expires" BWS "=" BWS cookie-date BWS
1285
+ ; cookie-date is defined in the "Dates" section.
1286
+ ~~~
1287
+
1246
1288
# ## The Max-Age Attribute
1247
1289
1248
1290
If the attribute-name case-insensitively matches the string "Max-Age", the
@@ -1268,6 +1310,16 @@ user agent MUST process the cookie-av as follows.
1268
1310
7. Append an attribute to the cookie-attribute-list with an attribute-name
1269
1311
of Max-Age and an attribute-value of expiry-time.
1270
1312
1313
+ Based on the parsing algorithm above, the syntax requirements for the Max-Age
1314
+ attribute are represented by the grammar below. Max-Age attributes not
1315
+ conforming to this grammar are ignored.
1316
+
1317
+ ~~~ abnf
1318
+ max-age-av = "Max-Age" BWS max-age-eq-value BWS
1319
+ max-age-eq-value = "" / ("=" BWS max-age-value)
1320
+ max-age-value = *1024(DIGIT) / ("-" *1023(DIGIT))
1321
+ ~~~
1322
+
1271
1323
# ## The Domain Attribute
1272
1324
1273
1325
If the attribute-name case-insensitively matches the string "Domain", the user
@@ -1283,6 +1335,18 @@ agent MUST process the cookie-av as follows.
1283
1335
4. Append an attribute to the cookie-attribute-list with an attribute-name
1284
1336
of Domain and an attribute-value of cookie-domain.
1285
1337
1338
+ Based on the parsing algorithm above, the syntax requirements for the Domain
1339
+ attribute are represented by the grammar below. Domain attributes not
1340
+ conforming to this grammar are ignored.
1341
+
1342
+ ~~~ abnf
1343
+ domain-av = "Domain" BWS domain-eq-value BWS
1344
+ domain-eq-value = "" / ("=" BWS domain-value)
1345
+ domain-value = optional-attr-value
1346
+ ; a leading %x2E (period) in domain-value will be
1347
+ ; removed if present.
1348
+ ~~~
1349
+
1286
1350
# ## The Path Attribute
1287
1351
1288
1352
If the attribute-name case-insensitively matches the string "Path", the user
@@ -1300,18 +1364,42 @@ agent MUST process the cookie-av as follows.
1300
1364
2. Append an attribute to the cookie-attribute-list with an attribute-name
1301
1365
of Path and an attribute-value of cookie-path.
1302
1366
1367
+ Based on the parsing algorithm above, the syntax requirements for the Path
1368
+ attribute are represented by the grammar below. Path attributes not conforming
1369
+ to this grammar are ignored.
1370
+
1371
+ ~~~ abnf
1372
+ path-av = "Path" BWS path-eq-value BWS
1373
+ path-eq-value = "" / ("=" BWS path-value)
1374
+ path-value = optional-attr-value
1375
+ ~~~
1376
+
1303
1377
# ## The Secure Attribute
1304
1378
1305
1379
If the attribute-name case-insensitively matches the string "Secure", the
1306
1380
user agent MUST append an attribute to the cookie-attribute-list with an
1307
1381
attribute-name of Secure and an empty attribute-value.
1308
1382
1383
+ The syntax requirements for the Secure attribute are represented by the
1384
+ grammar below. Secure attributes not conforming to this grammar are ignored.
1385
+
1386
+ ~~~ abnf
1387
+ secure-av = "Secure" BWS ignored-attr-eq-value BWS
1388
+ ~~~
1389
+
1309
1390
# ## The HttpOnly Attribute
1310
1391
1311
1392
If the attribute-name case-insensitively matches the string "HttpOnly", the
1312
1393
user agent MUST append an attribute to the cookie-attribute-list with an
1313
1394
attribute-name of HttpOnly and an empty attribute-value.
1314
1395
1396
+ The syntax requirements for the HttpOnly attribute are represented by the
1397
+ grammar below. HttpOnly attributes not conforming to this grammar are ignored.
1398
+
1399
+ ~~~ abnf
1400
+ httponly-av = "HttpOnly" BWS ignored-attr-eq-value BWS
1401
+ ~~~
1402
+
1315
1403
# ## The SameSite Attribute
1316
1404
1317
1405
If the attribute-name case-insensitively matches the string "SameSite", the
@@ -1331,6 +1419,16 @@ user agent MUST process the cookie-av as follows:
1331
1419
5. Append an attribute to the cookie-attribute-list with an attribute-name
1332
1420
of "SameSite" and an attribute-value of `enforcement`.
1333
1421
1422
+ Based on the parsing algorithm above, the syntax requirements for the SameSite
1423
+ attribute are represented by the grammar below. SameSite attributes not
1424
+ conforming to this grammar are ignored.
1425
+
1426
+ ~~~ abnf
1427
+ samesite-av = "SameSite" BWS samesite-eq-value BWS
1428
+ samesite-eq-value = "" / ("=" BWS samesite-value)
1429
+ samesite-value = "Strict" / "Lax" / "None" / ignored-attr-value
1430
+ ~~~
1431
+
1334
1432
# ### "Strict" and "Lax" enforcement {#strict-lax}
1335
1433
1336
1434
Same-site cookies in "Strict" enforcement mode will not be sent along with
@@ -1401,68 +1499,6 @@ with
1401
1499
elapsed since the cookie's creation-time is at most a duration of the
1402
1500
user agent's choosing.
1403
1501
1404
- # # Syntax {#ua-abnf-syntax}
1405
-
1406
- Based on the parsing algorithms defined above, the following grammar defines
1407
- the syntax requirements enforced by user agents when parsing
1408
- set-cookie-strings :
1409
-
1410
- ~~~ abnf
1411
- set-cookie = set-cookie-string
1412
- set-cookie-string = cookie-pair *( BWS ";" OWS cookie-av)
1413
- cookie-pair = *1(BWS cookie-name BWS "=") BWS cookie-value BWS
1414
- ; the sum of the lengths of cookie-name and cookie-value
1415
- ; must be less than or equal to 4096 octets
1416
-
1417
- cookie-name = *4096(cookie-name-octet)
1418
- cookie-value = *4096(cookie-value-octet)
1419
- cookie-name-octet = %x09 / %x20-3A / %x3C / %x3E-7E / %x80-FF
1420
- ; octets excluding non-whitespace CTLs,
1421
- ; semicolon, and equals
1422
- cookie-value-octet = %x09 / %x20-3A / %x3C-7E / %x80-FF
1423
- ; octets excluding non-whitespace CTLs and
1424
- ; semicolon
1425
-
1426
- cookie-av = expires-av / max-age-av / domain-av /
1427
- path-av / secure-av / httponly-av /
1428
- samesite-av / extension-av
1429
- ; attributes that don't conform to the grammars
1430
- ; below are ignored
1431
-
1432
- ignored-eq-value = "" / ("=" BWS ignored-value)
1433
- ignored-value = optional-value
1434
- optional-value = *1024(cookie-value-octet)
1435
-
1436
- expires-av = "Expires" BWS "=" BWS cookie-date BWS
1437
- ; cookie-date is defined in a separate grammar
1438
- ; in a previous section
1439
-
1440
- max-age-av = "Max-Age" BWS max-age-eq-value BWS
1441
- max-age-eq-value = "" / ("=" BWS max-age-value)
1442
- max-age-value = *1024(DIGIT) / ("-" *1023(DIGIT))
1443
-
1444
- domain-av = "Domain" BWS domain-eq-value BWS
1445
- domain-eq-value = "" / ("=" BWS domain-value)
1446
- domain-value = optional-value
1447
- ; a leading %x2E (period) in domain-value will be
1448
- ; removed if present
1449
-
1450
- path-av = "Path" BWS path-eq-value BWS
1451
- path-eq-value = "" / ("=" BWS path-value)
1452
- path-value = optional-value
1453
-
1454
- secure-av = "Secure" BWS ignored-eq-value BWS
1455
-
1456
- httponly-av = "HttpOnly" BWS ignored-eq-value BWS
1457
-
1458
- samesite-av = "SameSite" BWS samesite-eq-value BWS
1459
- samesite-eq-value = "" / ("=" BWS samesite-value)
1460
- samesite-value = "Strict" / "Lax" / "None" / ignored-value
1461
-
1462
- extension-av = 1*cookie-name-octet BWS extension-eq-value BWS
1463
- extension-eq-value = "" / ("=" BWS optional-value)
1464
- ~~~
1465
-
1466
1502
# # Storage Model {#storage-model}
1467
1503
1468
1504
The user agent stores the following fields about each cookie : name, value,
0 commit comments