dotnet/runtime

Support cookie values with comma

Open

#58,773 opened on Sep 7, 2021

View on GitHub
 (34 comments) (2 reactions) (0 assignees)C# (5,445 forks)batch import
area-System.Net.Httpbughelp wanted

Repository metrics

Stars
 (17,886 stars)
PR merge metrics
 (Avg merge 12d 11h) (661 merged PRs in 30d)

Description

The following code will fail.

cookieContainer.Add(new Cookie("foo", "ba,r", "/", "example.com"));

---> System.Net.CookieException: The 'Value'='ba,r' part of the cookie is invalid.

This means that c# does not allow commas, but major browsers (Chrome, Firefox) do.

Chrome, Edge, and Firefox are the ones that allow commas. The combined market share of these browsers is probably over 90%. This means that allowing commas is a de facto standard.

My opinion is that we should follow the de facto standards, not the standardization bodies, because our goal is not to follow standards, but to solve real problems.

We need to face this.

Similar discussion in Golang: https://github.com/golang/go/issues/7243

Contributor guide

Research direction
Investigate the cookie parser in System.Net to allow comma characters in cookie values by adjusting the validation logic, referencing browser behavior and the Go issue for context.
Tech stack
csharp
Domain
backend
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
C#
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
75