Cookies

Parsing the Cookie header by Tomcat

Issue

Current behaviour (8.0.0-RC10/7.0.50)

Proposed new behaviour

Strict Servlet (Netscape + RFC2109)

RFC 6265

0x80 to 0xFF in cookie value (Bug 55917)

IAE

TBD

TBD

TBD

CTL allowed in quoted cookie values (Bug 55918)

Allowed

TBD

TBD

TBD

Quoted values in V0 cookies (Bug 55920)

Quotes removed

TBD

TBD

TBD

Raw JSON in cookie values (Bug 55921)

TBD

TBD

TBD

TBD

Issues to add to the table above

Generating the Set-Cookie header by Tomcat

TODO: Need to define behaviour for each of the issues above.