Is comma a valid character in cookie-value

Question

In some web server, cookie with a comma in value will be split into two cookie (one with empty value). For example, "foo=bar,goo" will be treated just like "foo=bar;goo=". Is this right according to RFC?

I find this RFC document but don't know exactly what it means.

cookie-pair       = cookie-name "=" cookie-value
cookie-name       = token
cookie-value      = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
cookie-octet      = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
                   ; US-ASCII characters excluding CTLs,
                   ; whitespace DQUOTE, comma, semicolon,
                   ; and backslash

RFC 6265

Answer 1

cookie-pair       = cookie-name "=" cookie-value
cookie-name       = token
cookie-value      = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
cookie-octet      = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
                   ; US-ASCII characters excluding CTLs,
                   ; whitespace DQUOTE, comma, semicolon,
                   ; and backslash

What are those keywords: cookie-pair, cookie-name, cookie-value, cookie-octet?

cookie-value is the right-side part of =.

cookie-octet is the real value, enclosed in double quotes or nothing. See:

key="value"

or

key=value

When you put in a , (or ;) see what happens:

key="value,",key2="value2"

or

key=value,,key2=value2

So, your assumption is not quite correct and you must not use comma or semicolon inside the value.

Answer 2

NO they are not allowed.

From the specs:

This string is a sequence of characters excluding semi-colon, comma and white space.

The same can be checked in RFC2965 and RFC2616

Answer 3

According to the document's part you quoted, commas are not allowed:

US-ASCII characters excluding CTLs, whitespace DQUOTE, comma, semicolon, and backslash

However, I believe all modern browsers allow it anyway so use it at your risk. You can always use base64 or something similar depending on your goal if you need to encode special characters and stay compliant.