; Lenient version of https://datatracker.ietf.org/doc/html/rfc6265#section-4.2.1 lenient-cookie-string = lenient-cookie-entry *( ";" OWS lenient-cookie-entry ) lenient-cookie-entry = lenient-cookie-pair / lenient-cookie-pair-invalid lenient-cookie-pair = OWS lenient-cookie-name OWS "=" OWS lenient-cookie-value OWS lenient-cookie-pair-invalid = OWS 1*tchar OWS ; Allow for standalone entries like "fizz" to be ignored lenient-cookie-name = 1*( %x21-3A / %x3C / %x3E-7E ) ; Allow all printable US-ASCII except "=" lenient-cookie-value = lenient-quoted-value [ *lenient-cookie-octet ] / *lenient-cookie-octet lenient-quoted-value = DQUOTE *( lenient-quoted-char ) DQUOTE lenient-quoted-char = %x20-21 / %x23-7E ; Allow all printable US-ASCII except DQUOTE lenient-cookie-octet = %x21-2B / %x2D-3A / %x3C-7E ; Allow all printable characters except CTLs, semicolon and SP ; Lenient version of https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.1 ; following parsing algorithm of https://datatracker.ietf.org/doc/html/rfc6265#section-5.2 lenient-set-cookie-string = lenient-set-cookie-pair *( ";" lenient-cookie-av ) lenient-set-cookie-pair = *WSP lenient-set-cookie-name *WSP "=" *WSP lenient-set-cookie-value *WSP lenient-set-cookie-name = lenient-name-char *( *WSP lenient-name-char ) ; leading and trailing WSP is not part of the name lenient-set-cookie-value = [ lenient-value-char *( *WSP lenient-value-char ) ] ; leading and trailing WSP is not part of the value lenient-cookie-av = *WSP lenient-cookie-av-name *WSP [ "=" *WSP lenient-cookie-av-value *WSP ] lenient-cookie-av-name = [ lenient-name-char *( *WSP lenient-name-char ) ] lenient-cookie-av-value = [ lenient-value-char *( *WSP lenient-value-char ) ] ; CTLs (except HTAB) are not allowed, as they are not allowed in HTTP field values (https://www.rfc-editor.org/rfc/rfc9110#section-5.5) lenient-name-char = %x21-3A / %x3C / %x3E-7E / %x80-10FFFF ; any CHAR except CTLs, WSP, ";" and "=" lenient-value-char = %x21-3A / %x3C-7E / %x80-10FFFF ; any CHAR except CTLs, WSP and ";" ; https://datatracker.ietf.org/doc/html/rfc6265#section-4.2.1 cookie-string = cookie-pair *( ";" SP cookie-pair ) ; https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.1 ; https://www.rfc-editor.org/errata/eid5518 cookie-pair = cookie-name "=" cookie-value cookie-name = token cookie-value = ( DQUOTE *cookie-octet DQUOTE ) / *cookie-octet ; https://www.rfc-editor.org/errata/eid8242 cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E ; US-ASCII characters excluding CTLs, ; whitespace, DQUOTE, comma, semicolon, ; and backslash ; https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.1 set-cookie-string = cookie-pair *( ";" SP cookie-av ) cookie-av = extension-av ; MODIFICATION: originally ; cookie-av = expires-av / max-age-av / domain-av / ; path-av / secure-av / httponly-av / ; extension-av ; All the alternatives are subsets of extension-av. Parsers processing alternatives ; left-to-right without backtracking would commit to a partial match of a specific ; alternative (e.g. "Secure " or "Max-Age=60 ") and fail, instead of matching extension-av. expires-av = "Expires=" sane-cookie-date sane-cookie-date = rfc1123-date ; defined in [RFC2616], Section 3.3.1 max-age-av = "Max-Age=" non-zero-digit *DIGIT ; In practice, both expires-av and max-age-av ; are limited to dates representable by the ; user agent. non-zero-digit = %x31-39 ; digits 1 through 9 domain-av = "Domain=" domain-value domain-value = subdomain ; defined in [RFC1034], Section 3.5, as ; enhanced by [RFC1123], Section 2.1 path-av = "Path=" path-value path-value = *av-octet ; https://www.rfc-editor.org/errata/eid3444 secure-av = "Secure" httponly-av = "HttpOnly" extension-av = *av-octet ; https://www.rfc-editor.org/errata/eid3444 av-octet = %x20-3A / %x3C-7E ; any CHAR except CTLs or ";" ; https://datatracker.ietf.org/doc/html/rfc1034#section-3.5 ; https://datatracker.ietf.org/doc/html/rfc1123#section-2.1 subdomain = label *( "." label ) label = let-dig *( *"-" let-dig ) ; MODIFICATION: originally ;