News for hackers. Stuff that matters.
Re:HTTPWTF by richdougherty on Thursday March 04, 2021 @02:45PM (#26347194)
And some headers have their own exceptions to this.

The Set-Cookie header (sent by the server) should always be sent as multiple headers, not comma separated as user agents may follow Netscape's original spec.

  https://stackoverflow.com/questions/2880047/is-it-possible-to-set-more-than-one-cookie-with-a-single-set-cookie

  https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie
On the other hand in HTTP/1.1 the Cookie header should always be sent as a single header, not multiple. In HTTP/2, they may be sent as separate headers to improve compression. :)

  https://stackoverflow.com/questions/16305814/are-multiple-cookie-headers-allowed-in-an-http-request

There are no comments on this comment yet.