RFC 6265, "HTTP State Management Mechanism", April 2011

Errata ID: 8242
Status: Held for Document Update
Type: Technical
Publication Format(s) : TEXT
Reported By: Vladimír Gorej
Date Reported: 2025-01-06
Held for Document Update by: Orie Steele
Date Held: 2025-01-14

Section 4.1.1 says:

cookie-value      = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )

It should say:

cookie-value      = ( DQUOTE *cookie-octet DQUOTE ) / *cookie-octet

Notes:

Many parsers process ABNF alternatives left-to-right and do not backtrack if an alternative partially matches but ultimately fails. This is why placing *cookie-octet first can cause issues.

The quoted pattern ( DQUOTE *cookie-octet DQUOTE ) is more specific than the unquoted pattern *cookie-octet. Placing it first ensures that the parser prioritizes correctly. Quoted values are matched as a whole first. If the value isn’t quoted, the parser safely falls back to checking for unquoted *cookie-octet.

Report New Errata