Setting a slash on cookie path?

user_5445480 0
Viewed 3779

Is there a best practice whether to set a slash at the end of a cookie path? Is path better than path/ in any way? I found out that both versions result in different cookies, but I don't know which version is preferred.

cookies
3 Answers

As far as the server-side goes, this issue (https://bugzilla.mozilla.org/show_bug.cgi?id=469678) states:

Per RFC 2109 the default path of a cookie when set by Set-Cookie is:

Defaults to the path of the request URL that generated the Set-Cookie response, up to, but not including, the right-most /.

So this is one perspective where a trailing slash should not be used.

RFC History

RFC 2109, February 1997, HTTP State Management Mechanism

https://www.rfc-editor.org/rfc/rfc2109

  • See 4.3.1 Interpreting Set-Cookie
  • Defaults to the path of the request URL that generated the Set-Cookie response, up to, but not including, the right-most /.

DON'T include trailing '/'.

RFC 2965, October 2000, HTTP State Management Mechanism

Obsoletes: 2109

https://www.rfc-editor.org/rfc/rfc2965

  • See 3.3.1 Interpreting Set-Cookie2
  • Defaults to the path of the request URL that generated the Set-Cookie2 response, up to and including the right-most /.

DO include trailing '/'.

RFC 6265, April 2011, HTTP State Management Mechanism

Obsoletes: 2965

https://www.rfc-editor.org/rfc/rfc6265#section-5.2.4

  • See 5.1.4. Paths and Path-Match
  • -3. If the uri-path contains no more than one %x2F ("/") character, output %x2F ("/") and skip the remaining step.
  • -4. Output the characters of the uri-path from the first character up to, but not including, the right-most %x2F ("/").

DON'T include trailing '/'.

Client test

On the client, if you use the following code:

document.cookie="a=1"

you get these results from inspecting devtools for each browser (my site had a window.location.pathname="/selenium/tests/testCustomizeColumnsPage.html")

Chrome/71.0.3578   /selenium/tests
Firefox/64.0       /selenium/tests/
Edge               /selenium/tests/
IE11               devtools doesn't show cookies, think the path includes the trailing '/'

So is Chrome wrong here?

Other references:

user_3198780

We've just seen a bug in Safari on Iphone where cookies set without a trailing slash were empty. The bug affects one of the three Iphones I have in front of me, an Iphone 7 running IOS 11.3.1. In devtools, we can see the name of the cookie, but the value is not there. The same issue seems to have hit this user. We're putting trailing slashes on cookie pathes now !

user_15853450
Related