Cookies: HTTP State Management Mechanism

4.1.1. Syntax

Informally, the Set-Cookie response header field contains a cookie, which begins with a name-value-pair, followed by zero or more attribute-value pairs. Servers MUST send Set-Cookie header fields that conform to the following grammar:¶

set-cookie        = set-cookie-string
set-cookie-string = BWS cookie-pair *( BWS ";" OWS cookie-av )
cookie-pair       = cookie-name BWS "=" BWS cookie-value
cookie-name       = token
cookie-value      = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
cookie-octet      = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
                      ; US-ASCII characters excluding CTLs,
                      ; whitespace, DQUOTE, comma, semicolon,
                      ; and backslash
token             = <token, defined in [HTTP], Section 5.6.2>

cookie-av         = expires-av / max-age-av / domain-av /
                    path-av / secure-av / httponly-av /
                    samesite-av / extension-av
expires-av        = "Expires" BWS "=" BWS sane-cookie-date
sane-cookie-date  =
    <IMF-fixdate, defined in [HTTP], Section 5.6.7>
max-age-av        = "Max-Age" BWS "=" BWS 1*DIGIT
domain-av         = "Domain" BWS "=" BWS domain-value
domain-value      = <subdomain>
                      ; see details below
path-av           = "Path" BWS "=" BWS path-value
path-value        = *av-octet
secure-av         = "Secure"
httponly-av       = "HttpOnly"
samesite-av       = "SameSite" BWS "=" BWS samesite-value
samesite-value    = "Strict" / "Lax" / "None"
extension-av      = *av-octet
av-octet          = %x20-3A / %x3C-7E
                      ; any CHAR except CTLs or ";"

Note that some of the grammatical terms above reference documents that use different grammatical notations than this document (which uses ABNF from [RFC5234]).¶

Per the grammar above, servers MUST NOT produce nameless cookies (i.e., an empty cookie-name) as such cookies may be unpredictably serialized by user agents when sent back to the server.¶

The semantics of the cookie-value are not defined by this document.¶

To maximize compatibility with user agents, servers that wish to store arbitrary data in a cookie-value SHOULD encode that data, for example, using Base64 [RFC4648].¶

Per the grammar above, the cookie-value MAY be wrapped in DQUOTE characters. Note that in this case, the initial and trailing DQUOTE characters are not stripped. They are part of the cookie-value, and will be included in Cookie header fields sent to the server.¶

The domain-value is a subdomain as defined by [RFC1034], Section 3.5, and as enhanced by [RFC1123], Section 2.1. Thus, domain-value is a byte sequence of ASCII bytes.¶

The portions of the set-cookie-string produced by the cookie-av term are known as attributes. To maximize compatibility with user agents, servers SHOULD NOT produce two attributes with the same name in the same set-cookie-string.¶

NOTE: The name of an attribute-value pair is not case-sensitive. So while they are presented here in CamelCase, such as HttpOnly or SameSite, any case is accepted. E.g., httponly, Httponly, hTTPoNLY, etc.¶

Servers MUST NOT include more than one Set-Cookie header field in the same response with the same cookie-name. (See Section 5.5.1 for how user agents handle this case.)¶

If a server sends multiple responses containing Set-Cookie header fields concurrently to the user agent (e.g., when communicating with the user agent over multiple sockets), these responses create a "race condition" that can lead to unpredictable behavior.¶

NOTE: Some existing user agents differ in their interpretation of two-digit years. To avoid compatibility issues, servers SHOULD use the rfc1123-date format, which requires a four-digit year.¶

NOTE: Some user agents store and process dates in cookies as 32-bit UNIX time_t values. Implementation bugs in the libraries supporting time_t processing on some systems might cause such user agents to process dates after the year 2038 incorrectly.¶

4.1.2. Semantics (Non-Normative)

This section describes simplified semantics of the Set-Cookie header field. These semantics are detailed enough to be useful for understanding the most common uses of cookies by servers. The full semantics are described in Section 5.¶

When the user agent receives a Set-Cookie header field, the user agent stores the cookie together with its attributes. Subsequently, when the user agent makes an HTTP request, the user agent includes the applicable, non-expired cookies in the Cookie header field.¶

If the user agent receives a new cookie with the same cookie-name, domain-value, and path-value as a cookie that it has already stored, the existing cookie is evicted and replaced with the new cookie. Notice that servers can delete cookies by sending the user agent a new cookie with an Expires attribute with a value in the past.¶

Unless the cookie's attributes indicate otherwise, the cookie is returned only to the origin server (and not, for example, to any subdomains), and it expires at the end of the current session (as defined by the user agent). User agents ignore unrecognized cookie attributes (but not the entire cookie).¶

4.1.3. Cookie Name Prefixes

Section 8.5 and Section 8.6 of this document spell out some of the drawbacks of cookies' historical implementation. In particular, it is impossible for a server to have confidence that a given cookie was set with a particular set of attributes. In order to provide such confidence in a backwards-compatible way, two common sets of requirements can be inferred from the first few characters of the cookie's name.¶

To maximize compatibility with user agents, servers SHOULD use prefixes as described below.¶

Set-Cookie: __Secure-SID=12345; Domain=site.example

Set-Cookie: __Secure-SID=12345; Domain=site.example; Secure

Set-Cookie: __Host-SID=12345
Set-Cookie: __Host-SID=12345; Secure
Set-Cookie: __Host-SID=12345; Domain=site.example
Set-Cookie: __Host-SID=12345; Domain=site.example; Path=/
Set-Cookie: __Host-SID=12345; Secure; Domain=site.example; Path=/

Set-Cookie: __Host-SID=12345; Secure; Path=/

4.2.1. Syntax

The user agent sends stored cookies to the origin server in the Cookie header field. If the server conforms to the requirements in Section 4.1 (and the user agent conforms to the requirements in Section 5), the user agent will send a Cookie header field that conforms to the following grammar:¶

cookie        = cookie-string
cookie-string = cookie-pair *( ";" SP cookie-pair )

While Section 5.4 of [RFC9110] does not define a length limit for header fields it is likely that the web server's implementation does impose a limit; many popular implementations have default limits of 8 kibibytes. Servers SHOULD avoid setting a large number of large cookies such that the final cookie-string would exceed their header field limit. Not doing so could result in requests to the server failing.¶

Servers MUST be tolerant of multiple Cookie headers. For example, an HTTP/2 [RFC9113] or HTTP/3 [HTTP] client or intermediary might split a Cookie header to improve compression. Servers are free to determine what form this tolerance takes. For example, the server could process each Cookie header individually or the server could concatenate all the Cookie headers into one and then process that final, single, header. The server should be mindful of any header field limits when deciding which approach to take.¶

Note: Since intermediaries can modify Cookie headers they should also be mindful of common server header field limits in order to avoid sending servers headers that they cannot process. For example, concatenating multiple cookie headers into a single header might exceed a server's size limit.¶

4.2.2. Semantics

Each cookie-pair represents a cookie stored by the user agent. The cookie-pair contains the cookie-name and cookie-value the user agent received in the Set-Cookie header field.¶

Notice that the cookie attributes are not returned. In particular, the server cannot determine from the Cookie field alone when a cookie will expire, for which hosts the cookie is valid, for which paths the cookie is valid, or whether the cookie was set with the Secure or HttpOnly attributes.¶

The semantics of individual cookies in the Cookie header field are not defined by this document. Servers are expected to imbue these cookies with application-specific semantics.¶

Although cookies are serialized linearly in the Cookie header field, servers SHOULD NOT rely upon the serialization order. In particular, if the Cookie header field contains two cookies with the same name (e.g., that were set with different Path or Domain attributes), servers SHOULD NOT rely upon the order in which these cookies appear in the header field.¶

5.1.1. Cookie Store And Limits

A user agent has an associated cookie store, which is a list of cookies. It is initially « ».¶

A user agent has an associated total cookies-per-host limit, which is an integer. It SHOULD be 50 or more.¶

A user agent has an associated total cookies limit, which is an integer. It SHOULD be 3000 or more.¶

A user agent has an associated cookie age limit, which is a number of days. It SHOULD be 400 days or less (see Section 7.2).¶

5.1.2. Cookie Struct

A cookie is a struct that represents a piece of state to be transmitted between a client and a server.¶

A cookie's name is a byte sequence. It always needs to be set.¶

A cookie's value is a byte sequence. It always needs to be set.¶

A cookie's secure is a boolean. It is initially false.¶

A cookie's host is a domain, IP address, null, or failure. It is initially null. Note: Once a cookie is in the user agent's cookie store its host is a domain or IP address.¶

A cookie's host-only is a boolean. It is initially false.¶

A cookie's path is a URL path.¶

A cookie's has-path attribute is a boolean. It is initially false.¶

A cookie's same-site is "strict", "lax", "unset", or "none". It is initially "unset".¶

A cookie's http-only is a boolean. It is initially false.¶

A cookie's creation-time is a time. It is initially the current time.¶

A cookie's expiry-time is null or a time. It is initially null. Note: A prior version of this specification referred to null with a distinct "persistent-flag" field being false.¶

A cookie's last-access-time is a time. It is initially the current time.¶

5.2.1. Remove Expired Cookies

1. Let expiredCookies be a list of references to all expired cookies in the user agent's cookie store.¶

2. For each cookie of expiredCookies:¶

   1. Remove cookie from the user agent's cookie store.¶

3. Return expiredCookies.¶

5.2.2. Remove Excess Cookies for a Host

To Remove Excess Cookies for a Host given a host host:¶

1. Let insecureCookies be a list of references to all cookies in the user agent's cookie store whose host is host-equal to host and whose secure is false.¶

2. Sort insecureCookies by earliest last-access-time first.¶

3. Let secureCookies be a list of references to all cookies in the user agent's cookie store whose host is host-equal to host and whose secure is true.¶

4. Sort secureCookies by earliest last-access-time first.¶

5. Let excessHostCookies be an empty list of cookies.¶

6. While insecureCookies's size + secureCookies's size is greater than the user agent's total cookies-per-host limit:¶

   1. If insecureCookies is not empty:¶

      1. Let cookie be the first item of insecureCookies.¶

      2. Remove cookie from insecureCookies.¶

      3. Remove cookie from the user agent's cookie store.¶

      4. Append cookie to excessHostCookies.¶

   2. Otherwise:¶

      1. Let cookie be the first item of secureCookies.¶

      2. Remove cookie from secureCookies.¶

      3. Remove cookie from the user agent's cookie store.¶

      4. Append cookie to excessHostCookies.¶

7. Return excessHostCookies.¶

5.2.3. Remove Global Excess Cookies

To Remove Global Excess Cookies:¶

1. Let allCookies be the result of sorting the user agent's cookie store by earliest last-access-time first.¶

2. Let excessGlobalCookies be an empty list of cookies.¶

3. While allCookies's size is greater than the user agent's total cookies limit:¶

   1. Let cookie be the first item of allCookies.¶

   2. Remove cookie from allCookies.¶

   3. Remove cookie from the user agent's cookie store.¶

   4. Append cookie to excessGlobalCookies.¶

4. Return excessGlobalCookies.¶

5.3.1. Parse a Date

To Parse a Date given a byte sequence input, run these steps. They return a date and time or failure.¶

Note that the various boolean flags defined as a part of the algorithm (i.e., found-time, found-day-of-month, found-month, found-year) are initially "not set".¶

1. Using the grammar below, divide the cookie-date into date-tokens.¶

   cookie-date     = *delimiter date-token-list *delimiter
   date-token-list = date-token *( 1*delimiter date-token )
   date-token      = 1*non-delimiter
   
   delimiter       = %x09 / %x20-2F / %x3B-40 / %x5B-60 / %x7B-7E
   non-delimiter   = %x00-08 / %x0A-1F / DIGIT / ":" / ALPHA
                     / %x7F-FF
   non-digit       = %x00-2F / %x3A-FF
   
   day-of-month    = 1*2DIGIT [ non-digit *OCTET ]
   month           = ( "jan" / "feb" / "mar" / "apr" /
                       "may" / "jun" / "jul" / "aug" /
                       "sep" / "oct" / "nov" / "dec" ) *OCTET
   year            = 2*4DIGIT [ non-digit *OCTET ]
   time            = hms-time [ non-digit *OCTET ]
   hms-time        = time-field ":" time-field ":" time-field
   time-field      = 1*2DIGIT
   

   ¶

2. Process each date-token sequentially in the order the date-tokens appear in the cookie-date:¶

   1. If the found-time flag is not set and the token matches the time production, set the found-time flag and set the hour-value, minute-value, and second-value to the numbers denoted by the digits in the date-token, respectively. Skip the remaining sub-steps and continue to the next date-token.¶

   2. If the found-day-of-month flag is not set and the date-token matches the day-of-month production, set the found-day-of-month flag and set the day-of-month-value to the number denoted by the date-token. Skip the remaining sub-steps and continue to the next date-token.¶

   3. If the found-month flag is not set and the date-token matches the month production, set the found-month flag and set the month-value to the month denoted by the date-token. Skip the remaining sub-steps and continue to the next date-token.¶

   4. If the found-year flag is not set and the date-token matches the year production, set the found-year flag and set the year-value to the number denoted by the date-token. Skip the remaining sub-steps and continue to the next date-token.¶

3. If the year-value is greater than or equal to 70 and less than or equal to 99, increment the year-value by 1900.¶

4. If the year-value is greater than or equal to 0 and less than or equal to 69, increment the year-value by 2000.¶

   1. NOTE: Some existing user agents interpret two-digit years differently.¶

5. If one of the following is true:¶

   • at least one of the found-day-of-month, found-month, found-year, or found-time flags is not set,¶

   • the day-of-month-value is less than 1 or greater than 31,¶

   • the year-value is less than 1601,¶

   • the hour-value is greater than 23,¶

   • the minute-value is greater than 59, or¶

   • the second-value is greater than 59,¶

   then return failure.¶

   (Note that leap seconds cannot be represented in this syntax.)¶

6. Let the parsed-cookie-date be the date whose day-of-month, month, year, hour, minute, and second (in UTC) are the day-of-month-value, the month-value, the year-value, the hour-value, the minute-value, and the second-value, respectively. If no such date exists, abort these steps and fail to parse the cookie-date.¶

7. Return the parsed-cookie-date as the result of this algorithm.¶

5.3.2. Domain Matching

A host host Domain-Matches a string domainAttributeValue if at least one of the following is true:¶

• host equals domainAttributeValue, or¶

• if all of the following are true:¶

  • host is a domain, and¶

  • host ends with the concatenation of U+002E (.) and domainAttributeValue.¶

5.3.3. Cookie Default Path

To determine the Cookie Default Path, given a URL path path, run these steps. They return a URL path.¶

1. Assert: path is a non-empty list.¶

2. If path's size is greater than 1, then remove path's last item.¶

3. Otherwise, set path[0] to the empty string.¶

4. Return path.¶

5.3.4. Path Matching

To determine if a URL path requestPath Path-Matches a URL path cookiePath, run these steps. They return a boolean.¶

1. Let serializedRequestPath be the result of URL path serializing requestPath.¶

2. Let serializedCookiePath be the result of URL path serializing cookiePath.¶

3. If serializedCookiePath is serializedRequestPath, then return true.¶

4. If serializedRequestPath starts with serializedCookiePath and serializedCookiePath ends with a U+002F (/), then return true.¶

5. Return whether the concatenation of serializedRequestPath followed by U+002F (/) starts with serializedCookiePath.¶

5.4.1. Parse and Store a Cookie

To Parse and Store a Cookie given a byte sequence input, boolean isSecure, domain or IP address host, URL path path, boolean httpOnlyAllowed, boolean allowNonHostOnlyCookieForPublicSuffix, and boolean sameSiteStrictOrLaxAllowed:¶

1. Let cookie be the result of running Parse a Cookie with input, isSecure, host, and path.¶

2. If cookie is failure, then return.¶

3. Return the result of Store a Cookie given cookie, isSecure, host, path, httpOnlyAllowed, allowNonHostOnlyCookieForPublicSuffix, and sameSiteStrictOrLaxAllowed.¶

5.4.2. Parse a Cookie

To Parse a Cookie given a byte sequence input, boolean isSecure, host host, URL path path, run these steps. They return a new cookie or failure:¶

1. If input contains a byte in the range 0x00 to 0x08, inclusive, the range 0x0A to 0x1F inclusive, or 0x7F (CTL bytes excluding HTAB), then return failure.¶

2. Let nameValueInput be null.¶

3. Let attributesInput be the empty byte sequence.¶

4. If input contains 0x3B (;), then set nameValueInput to the bytes up to, but not including, the first 0x3B (;), and attributesInput to the remainder of input (including the 0x3B (;) in question).¶

5. Otherwise, set nameValueInput to input.¶

6. Assert: nameValueInput is a byte sequence.¶

7. Let name be null.¶

8. Let value be null.¶

9. If nameValueInput does not contain a 0x3D (=) character, then set name to the empty byte sequence, and value to nameValueInput.¶

10. Otherwise, set name to the bytes up to, but not including, the first 0x3D (=), and set value to the bytes after the first 0x3D (=) (possibly being the empty byte sequence).¶

11. Remove any leading or trailing WSP bytes from name and value.¶

12. If name's length + value's length is 0 or is greater than 4096, then return failure.¶

13. Let cookie be a new cookie whose name is name and value is value.¶

14. Set cookie's path to the result of running Cookie Default Path with path.¶

    Note: A Path attribute can override this.¶

15. While attributesInput is not an empty byte sequence:¶

    1. Let maxAgeSeen be false.¶

    2. Let char be the result of consuming the first byte of attributesInput.¶

    3. Assert: char is 0x3B (;).¶

    4. Let attributeNameValueInput be null.¶

    5. If attributesInput contains 0x3B (;), then set attributeNameValueInput to the result of consuming the bytes of attributesInput up to, but not including, the first 0x3B (;).¶

    6. Otherwise, set attributeNameValueInput to the result of consuming the remainder of attributesInput.¶

    7. Let attributeName be null.¶

    8. Let attributeValue be the empty string.¶

    9. If attributeNameValueInput contains a 0x3D (=), then set attributeName to the bytes up to, but not including, the first 0x3D (=) of attributeNameValueInput, and attributeValue to the bytes after the first 0x3D (=) of attributeNameValueInput.¶

    10. Otherwise, set attributeName to attributeNameValueInput.¶

    11. Remove any leading or trailing WSP bytes from attributeName and attributeValue.¶

    12. If attributeValue's length is greater than 1024, then continue.¶

    13. If attributeName is a byte-case-insensitive match for Expires:¶

        1. If maxAgeSeen is true, then continue.¶

        2. Let expiryTime be the result of running Parse a Date given attributeValue.¶

        3. If attributeValue is failure, then continue.¶

        4. If expiryTime is greater than the current time and date + the user agent's cookie age limit, then set expiryTime to the user agent's cookie age limit.¶

        5. If expiryTime is earlier than the earliest date the user agent can represent, the user agent MAY replace expiryTime with the earliest representable date.¶

        6. Set cookie's expiry-time to expiryTime.¶

    14. If attributeName is a byte-case-insensitive match for Max-Age:¶

        1. If attributeValue is empty, continue.¶

        2. If the first byte of attributeValue is neither a DIGIT, nor 0x2D (-) followed by a DIGIT, then continue.¶

        3. If the remainder of attributeValue contains a non-DIGIT, then continue.¶

        4. Let deltaSeconds be attributeValue, converted to a base 10 integer.¶

        5. Set deltaSeconds to the smaller of deltaSeconds and the user agent's cookie age limit, in seconds.¶

        6. If deltaSeconds is less than or equal to 0, let expiryTime be the earliest representable date and time. Otherwise, let expiryTime be the current date and time + deltaSeconds seconds.¶

        7. Set cookie's expiry-time to expiryTime.¶

        8. Set maxAgeSeen to true.¶

    15. If attributeName is a byte-case-insensitive match for Domain:¶

        1. Let host be failure.¶

        2. If attributeValue contains only ASCII bytes:¶

           1. Let hostInput be attributeValue, ASCII decoded.¶

           2. If hostInput starts with U+002E (.), then set hostInput to hostInput without its leading U+002E (.).¶

           3. Set host to the result of host parsing hostInput.¶

        3. Set cookie's host to host.¶

    16. If attributeName is a byte-case-insensitive match for Path:¶

        1. If attributeValue is not empty and if the first byte of attributeValue is 0x2F (/), then:¶

           1. Set cookie's path to attributeValue split on 0x2F (/).¶

           2. Set cookie's has-path attribute to true.¶

    17. If attributeName is a byte-case-insensitive match for Secure:¶

        1. Set cookie's secure to true.¶

    18. If attributeName is a byte-case-insensitive match for HttpOnly:¶

        1. Set cookie's http-only to true.¶

    19. If attributeName is a byte-case-insensitive match for SameSite:¶

        1. If attributeValue is a byte-case-insensitive match for None, then set cookie's same-site to "none".¶

        2. If attributeValue is a byte-case-insensitive match for Strict, then set cookie's same-site to "strict".¶

        3. If attributeValue is a byte-case-insensitive match for Lax, then set cookie's same-site to "lax".¶

16. Return cookie.¶

Note: Attributes with an unrecognized attributeName are ignored.¶

Note: This intentionally overrides earlier cookie attributes so that generally the last specified cookie attribute "wins".¶

5.4.3. Store a Cookie

To Store a Cookie given a cookie cookie, boolean isSecure, domain or IP address host, boolean httpOnlyAllowed, boolean allowNonHostOnlyCookieForPublicSuffix, and boolean sameSiteStrictOrLaxAllowed, run these steps. They return cookie, or null if cookie was not stored or cannot be distinguished from the cookie it replaced:¶

1. Assert: cookie's name's length + cookie's value's length is not 0 or greater than 4096.¶

2. Assert: cookie's name does not contain a byte in the range 0x00 to 0x08, inclusive, in the range 0x0A to 0x1F, inclusive, or 0x7F (CTL characters excluding HTAB).¶

3. If cookie's host is failure, then return null.¶

4. Set cookie's creation-time and last-access-time to the current date and time.¶

5. If allowNonHostOnlyCookieForPublicSuffix is false and cookie's host is a public suffix:¶

   1. If cookie's host is host-equal to host, then set cookie's host to null.¶

   2. Otherwise, return null.¶

   Note: This step prevents attacker.example from disrupting the integrity of site.example by setting a cookie with a Domain attribute of example. In the event the end user navigates directly to example, a cookie can still be set and will forcibly have its host-only set to true.¶

6. If cookie's host is null:¶

   1. Set cookie's host-only to true.¶

   2. Set cookie's host to host.¶

7. Otherwise:¶

   1. If host does not Domain-Match cookie's host, then return null.¶

   2. If cookie's host is an IP address and is host-equal to host, then set cookie's host-only to true.¶

   3. Otherwise, set cookie's host-only to false.¶

8. Assert: cookie's host is a domain or IP address.¶

9. If httpOnlyAllowed is false and cookie's http-only is true, then return null.¶

10. If isSecure is false:¶

    1. If cookie's secure is true, then return null.¶

    2. If the user agent's cookie store contains at least one cookie existingCookie that meets all of the following criteria:¶

       1. existingCookie's name is cookie's name;¶

       2. existingCookie's secure is true;¶

       3. existingCookie's host Domain-Matches cookie's host, or vice-versa; and¶

       4. cookie's path Path-Matches existingCookie's path,¶

       then return null.¶

       Note: The path comparison is not symmetric, ensuring only that a newly-created, non-secure cookie does not overlay an existing secure cookie, providing some mitigation against cookie-fixing attacks. That is, given an existing secure cookie named 'a' with a path of '/login', a non-secure cookie named 'a' could be set for a path of '/' or '/foo', but not for a path of '/login' or '/login/en'.¶

11. If cookie's same-site is not "none" and sameSiteStrictOrLaxAllowed is false, then return null.¶

12. If cookie's same-site is "none" and cookie's secure is false, then return null.¶

13. If cookie's name, byte-lowercased, starts with __secure- and cookie's secure is false, then return null.¶

    Note: The check here and those below are with a byte-lowercased value in order to protect servers that process these values in a case-insensitive manner.¶

14. If cookie's name, byte-lowercased, starts with __host- and cookie is not Host-prefix compatible, then return null.¶

15. If cookie's name, byte-lowercased, starts with __http- and cookie is not Http-prefix compatible, then return null.¶

16. If cookie's name, byte-lowercased, starts with __host-http- and cookie is not both Host-prefix compatible and Http-prefix compatible, then return null.¶

17. If cookie's name is the empty byte sequence and one of the following is true:¶

    • cookie's value, byte-lowercased, starts with __secure-,¶

    • cookie's value, byte-lowercased, starts with __host-,¶

    • cookie's value, byte-lowercased, starts with __http-, or¶

    • cookie's value, byte-lowercased, starts with __host-http-,¶

    then return null.¶

18. Let changed be true.¶

19. If the user agent's cookie store contains a cookie oldCookie whose name is cookie's name, host is host-equal to cookie's host, host-only is cookie's host-only, and path is path-equal to cookie's path:¶

    1. If httpOnlyAllowed is false and oldCookie's http-only is true, then return null.¶

    2. If cookie's value is equal to oldCookie's value, cookie's secure is equal to oldCookie's secure, cookie's http-only is equal to oldCookie's http-only, cookie's same-site is equal to oldCookie's same-site, and cookie's expiry-time is equal to oldCookie's expiry-time, then set changed to false.¶

    3. Set cookie's creation-time to oldCookie's creation-time.¶

    4. Remove oldCookie from the user agent's cookie store.¶

    Note: This algorithm maintains the invariant that there is at most one such cookie.¶

20. Insert cookie into the user agent's cookie store.¶

21. If changed is false, then return null.¶

22. Return cookie.¶

5.4.4. Garbage Collect Cookies

To Garbage Collect Cookies given a host host:¶

1. Let expiredCookies be the result of running Remove Expired Cookies.¶

2. Let excessHostCookies be the result of running Remove Excess Cookies for Host given host.¶

3. Let excessGlobalCookies be the result of running Remove Global Excess Cookies.¶

4. Let removedCookies be « ».¶

5. For each cookieList of « expiredCookies, excessHostCookies, excessGlobalCookies », do the following:¶

   1. Extend removedCookies with cookieList.¶

6. Return removedCookies¶

5.4.5. Retrieve Cookies

To Retrieve Cookies given a boolean isSecure, host host, URL path path, boolean httpOnlyAllowed, and string sameSite:¶

1. Assert: sameSite is "strict-or-less", "lax-or-less", "unset-or-less", or "none".¶

2. Let cookies be all cookies from the user agent's cookie store that meet these conditions:¶

   • One of the following is true:¶

     • cookie's host-only is true and host is host-equal to cookie's host, or¶

     • cookie's host-only is false and host Domain-Matches cookie's host.¶

     It's possible that the public suffix list changed since a cookie was created. If this change results in a cookie's host becoming a public suffix and the cookie's host-only is false, then that cookie SHOULD NOT be returned.¶

     XXX: We should probably move this requirement out-of-bound as this invalidation should happen as part of updating the public suffixes.¶

   • path Path-Matches cookie's path.¶

   • One of the following is true:¶

     • cookie's secure is true and isSecure is true, or¶

     • cookie's secure is false.¶

   • One of the following is true:¶

     • cookie's http-only is true and httpOnlyAllowed is true, or¶

     • cookie's http-only is false.¶

   • One of the following is true:¶

     • cookie's same-site is "strict" and sameSite is "strict-or-less";¶

     • cookie's same-site is "lax" and sameSite is one of "strict-or-less" or "lax-or-less";¶

     • cookie's same-site is "unset" and sameSite is one of "strict-or-less", "lax-or-less", or "unset-or-less"; or¶

     • cookie's same-site is "none".¶

3. Sort cookies in the following order:¶

   • Cookies whose path's size is greater are listed before cookies whose path's size is smaller.¶

   • Among cookies whose path's size is equal, cookies whose creation-time is earlier are listed before cookies whose creation-time is later.¶

4. Set the last-access-time of each cookie of cookies to the current date and time and reflect these changes in the user agent's cookie store.¶

5. Return cookies.¶

5.4.6. Serialize Cookies

To Serialize Cookies given a list of cookies cookies:¶

1. Let output be an empty byte sequence.¶

2. For each cookie of cookies:¶

   1. If output is not the empty byte sequence, then append 0x3B (;) followed by 0x20 (SP) to output.¶

   2. If cookie's name is not the empty byte sequence, then append cookie's name followed by 0x3D (=) to output.¶

   3. Append cookie's value to output.¶

3. Return output.¶

5.5.1. The Set-Cookie Header Field

When a user agent receives a Set-Cookie header field in an HTTP response, the user agent MAY ignore the Set-Cookie header field in its entirety as per its cookie policy (see Section 7.2).¶

User agents MAY ignore Set-Cookie header fields contained in responses with 100-level status codes.¶

Set-Cookie header fields contained in responses with non-100-level status codes (including those in responses with 400- and 500-level status codes) SHOULD be processed as follows:¶

1. Let isSecure be a boolean indicating whether request's URL's scheme is deemed secure, in an implementation-defined manner.¶

2. Let host be request's host.¶

3. Let path be request's URL's path.¶

4. Let httpOnlyAllowed be true.¶

5. Let allowNonHostOnlyCookieForPublicSuffix be a boolean whose value is implementation-defined.¶

6. Let sameSiteStrictOrLaxAllowed be a boolean whose value is implementation-defined.¶

7. Let cookie be the result of running Parse and Store a Cookie given the header field value, isSecure, host, path, httpOnlyAllowed, allowNonHostOnlyCookieForPublicSuffix, and sameSiteStrictOrLaxAllowed.¶

8. If cookie is null, then return.¶

9. Run Garbage Collect Cookies given cookie's host.¶

5.5.2. The Cookie Header Field

The user agent includes stored cookies in the Cookie request header field.¶

When the user agent generates an HTTP request, the user agent MUST NOT attach more than one Cookie header field.¶

A user agent MAY omit the Cookie header field in its entirety.¶

If the user agent does attach a Cookie header field to an HTTP request, the user agent MUST compute its value as follows:¶

1. Let isSecure be a boolean indicating whether request's URL's scheme is deemed secure, in an implementation-defined manner.¶

2. Let host be request's host.¶

3. Let path be request's URL's path.¶

4. Let httpOnlyAllowed be true.¶

5. Let sameSite be a string whose value is implementation-defined, but has to be one of "strict-or-less", "lax-or-less", "unset-or-less", or "none".¶

6. Let cookies be the result of running Retrieve Cookies given isSecure, host, path, httpOnlyAllowed, and sameSite.¶

7. Return the result of running Serialize Cookies given cookies.¶

Note: Previous versions of this specification required that only one Cookie header field be sent in requests. This is no longer a requirement. While this specification requires that a single cookie-string be produced, some user agents may split that string across multiple Cookie header fields. For examples, see Section 8.2.3 of [RFC9113] and Section 4.2.1 of [HTTP].¶

5.5.3. Cookie Store Eviction for Non-Browser User Agents

The user agent SHOULD evict all expired cookies from its cookie store if, at any time, an expired cookie exists in the cookie store, by calling Remove Expired Cookies.¶

When "the current session is over" (as defined by the user agent), the user agent MUST remove from the cookie store all cookies whose expiry-time is null.¶