I recently had to debug an (old) web app that had to check a session cookie and was failing under some circumstance. Turns out that the library code that had to parse the HTTP Cookie header did not like the fact that one of the cookies in the header had a value that was a JSON object:
Cookie: lt-session-data={"id":"0.198042fc1767138e549","lastUpdatedDate":"2020-12-17T10:22:25Z"}; sessionid=a7f2f57d0b9a3247a350d9157fcbf9c2
(The lt-session-data cookie comes from LucidChart and ends up tagged with our domain because of the user visiting one of our Confluence pages with an embedded LucidChart diagram.)
It seems clear that the library I am using is applying the rules of RFC6265 in a strict manner:
cookie-value = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
; US-ASCII characters excluding CTLs,
; whitespace DQUOTE, comma, semicolon,
; and backslash
According to this, the JSON cookie value breaks at least two rules (no DQUOTE, no comma), and possibly more, depending on the data items in the JSON object (e.g. strings that may contain arbitrary characters).
My question is, is this common practice? Both Firefox and Chrome seem to accept this cookie without any issue, even though it goes against the RFC standard. I tried Googling for standards, but only RFC6265 turns up. It seems people just started putting JSON values in cookies.
If this is now common practice, and not a misguided effort by people who didn't bother to read the relevant standard docs, is there an updated standard?