F.4 Specification

A cookie is introduced to the client by including a Set-Cookie header as part of an HTTP response; typically this will be generated by a CGI script.

Set-Cookie: name=value; expires=date;
path=path; domain=domain_name; secure

Syntax of the Cookie HTTP Request Header

When requesting a URL from an HTTP server, the browser will match the URL against all cookies and if any of them match, a line containing the name/value pairs of all matching cookies will be included in the HTTP request. Here is the format of that line:

Cookie: NAME1=OPAQUE_STRING1; NAME2=OPAQUE_STRING2 ...

Additional Notes

• Multiple Set-Cookie headers can be issued in a single server response.

• Instances of the same path and name will overwrite each other, with the latest instance taking precedence. Instances of the same path but different names will add additional mappings.

• Setting the path to a higher-level value does not override other more specific path mappings. If there are multiple matches for a given cookie name, but with separate paths, all the matching cookies will be sent. (See examples below.)

• The expires header lets the client know when it is safe to purge the mapping but the client is not required to do so. A client may also delete a cookie before its expiration date arrives if the number of cookies exceeds its internal limits.

• When sending cookies to a server, all cookies with a more specific path mapping should be sent before cookies with less specific path mappings. For example, a cookie "name1=foo" with a path mapping of / should be sent after a cookie "name1=foo2" with a path mapping of /bar if they are both to be sent.

• There are limitations on the number of cookies that a client can store at any one time. This is a specification of the minimum number of cookies that a client should be prepared to receive and store:
  • 300 total cookies;

  • 4 kilobytes per cookie, where the name and the OPAQUE_STRING combine to form the 4 kilobyte limit;

  • 20 cookies per server or domain (note that completely specified hosts and domains are treated as separate entities and have a 20-cookie limitation for each, not combined).

  Servers should not expect clients to be able to exceed these limits. When the 300-cookie limit or the 20-cookie-per-server limit is exceeded, clients should delete the least recently used cookie. When a cookie larger than 4 kilobytes is encountered the cookie should be trimmed to fit, but the name should remain intact as long as it is less than 4 kilobytes.

• If a CGI script wishes to delete a cookie, it can do so by returning a cookie with the same name, and an expires time which is in the past. The path and name must match exactly in order for the expiring cookie to replace the valid cookie. This requirement makes it difficult for anyone but the originator of a cookie to delete a cookie.

• When caching HTTP, as a proxy server might do, the Set-cookie response header should never be cached.

• If a proxy server receives a response which contains a Set-cookie header, it should propagate the Set-cookie header to the client, regardless of whether the response was 304 (Not Modified) or 200 (OK).

  Similarly, if a client request contains a Cookie: header, it should be forwarded through a proxy, even if the conditional If-modified-since request is being made.