keksbruch — parser divergence matrix

How cookie parsers across languages handle the same difficult and malformed wire — surfacing where implementations diverge. Generated by cargo test -p keksbruch --features differential -- --ignored.

Legend

symbol	meaning
`[n=v, …]`	a request `Cookie:` header parsed into these name=value pairs, in order
`∅`	parsed successfully, but into zero cookies
`name=value ;Attr;…`	a `Set-Cookie` parsed into one cookie, with its attributes after the `;`
`❌`	the parser rejected the whole header or cookie (fail-hard)
`n/a`	the parser does not handle this direction (e.g. a request-only library asked to parse a `Set-Cookie`)
`SKIP`	the parser or its toolchain was unavailable in this run
`☠️`	the parser crashed on this payload — an in-process panic, or a sidecar killed by a signal, a non-zero exit, or a hang
`⚠️`	the parser accepted the cookie/header but reported recovered issues — hover the cell for the list; issues never affect the outcome or the consensus vote
`≡`	a proxy (nginx) forwarded the cookie byte-for-byte
`≠ …`	a proxy forwarded the cookie but altered the bytes (the altered value follows)
`⟨array⟩ / ⟨object⟩`	the value was parsed as a non-string type — PHP's `$_COOKIE` arrays/maps — shown by type name
`☢️`	on a `Set-Cookie`, the tool's parse contradicts kekse's typed reading: it stored a cookie kekse rejects, read an attribute value differently, or asserted one kekse never parsed (hover in the HTML report for the field-by-field comparison)
`Path⇒default`	a jar dropped the wire's unusable or absent `Path` and scoped the cookie to its request default-path (§5.1.4); the harness value (browsers `/r`, curl/wget/libcurl/HttpClient5 `/`) is plumbing, so the fall-back is stated, not printed

A bold cell differs from the real-world consensus — the modal outcome of the other parsers. A ☢️ cell is the mirror axis: it contradicts kekse, the subject we assert is correct, rather than the crowd — the two marks are independent, and a cell may carry both. kekse — and, on the jar probes, the rfc_6265 reference — is a subject under test, excluded from the consensus vote. Rows are tools, columns are tests; the payload row is the exact wire (non-displayable bytes shown \0 \r \n \xNN). The matrix is split into three tables: the request Cookie: parsers, the response Set-Cookie: parsers, and the jar probes (client stores exercised end-to-end), each listing only the tools that engage that axis (so none is a wall of n/a).

Request Cookie: parsers

tool	ws-surrounding	ws-internal	ctl-nul	ctl-crlf	ctl-other	quote-unbalanced	quote-interior	pct-truncated	pct-bad-utf8	raw-non-utf8	delim-semicolon	delim-empty-segments	no-equals	extra-equals	lines-second-visible	lines-single	lines-empty-line	lines-trailing-semicolon	lines-obs-text-line	lines-comma-folded	dup-name	dup-case	empty-name	empty-value	raw-non-ascii	non-ascii-name	scale-huge-value	scale-many-pairs	scale-control-junk	req-partitioned-name	nul-in-name	nul-between-cookies	tab-around	raw-emoji	pct-emoji	array-name	assoc-name	json-value	bracket-value	markup-no-equals	markup-name	quoted-html-value	truthy	equals-bare	equals-double	nul-empty-name
payload	`n = v`	`n=a b`	`n=a\0b; m=ok`	`n=a\r\nb; m=ok`	`n=a\x01b; m=ok`	`n="v; m=ok`	`n=a"b; m=ok`	`n=%4; m=ok`	`n=%FF; m=ok`	`n=a\xffb`	`n=a;evil=1`	`n=v;;;m=w`	`flag; n=v`	`n=a=b`	`other=x; SID=deadbeef`	`n=v`	`a=1; ; b=2`	`n=a;; SID=x`	`bad=caf\xe9; good=1; SID=deadbeef`	`a=1, SID=x`	`k=1; k=2; k=3`	`sid=lo; SID=hi`	`=v; m=ok`	`n=; m=ok`	`n=café; m=ok`	`naïve=v; m=ok`	`n=xxxxxxxxxxxxxxxxxxxxxxxxxx…<4098>`	`k0=v0; k1=v1; k2=v2; k3=v3; …<172>`	`a=1; j=\x01\x01\x01\x01\x01\…<16396>`	`Partitioned=false; m=ok`	`n\0x=v; m=ok`	`a=1; \0b=2; c=3`	`\tn\t=\tv\t; m=ok`	`n=🤖; m=ok`	`n=%F0%9F%A4%96; m=ok`	`token[]=nested; m=ok`	`sess[k]=v; m=ok`	`data={"testdata":"JSON"}; m=ok`	`data=[nested]; m=ok`	`<script>; m=ok`	`<script>=empty; m=ok`	`data="<img src=x />"; m=ok`	`truthy=yes; m=ok`	`=`	`==`	`\0=; m=ok`
RFC (standard)	—	—	—	—	—	—	—	—	—	—	`;` splits → 2 pairs	—	skip bad pair, keep rest	split on first `=`	field lines join with `;` (RFC 9113 §8.2.3)	field lines join with `;` (RFC 9113 §8.2.3)	field lines join with `;` (RFC 9113 §8.2.3)	field lines join with `;` (RFC 9113 §8.2.3)	field lines join with `;` (RFC 9113 §8.2.3)	Cookie is exempt from the RFC 9110 §5.2 comma fold	all duplicates kept	—	skip bad pair, keep rest	empty value is valid	—	—	—	—	—	—	—	—	—	—	—	non-token name skipped	non-token name skipped	DQUOTE is not a cookie-octet	`[` `]` are cookie-octets	skip bad pair, keep rest	non-token name skipped	—	—	skip bad pair, keep rest	skip bad pair, keep rest	non-token name skipped
consensus	`[n=v]`	`[n=a b]`	`[n=a\0b, m=ok]`	`[n=a\r\nb, m=ok]`	`[n=a\x01b, m=ok]`	`[n="v, m=ok]`	`[n=a"b, m=ok]`	`[n=%4, m=ok]`	`[n=%FF, m=ok]`	`[n=aÿb]`	`[n=a, evil=1]`	`[n=v, m=w]`	`[flag=, n=v]`	`[n=a=b]`	`[other=x, SID=deadbeef]`	`[n=v]`	`[a=1, b=2]`	`[n=a, SID=x]`	`[bad=café, good=1, SID=deadbeef]`	`[a=1, SID=x]`	`[k=1, k=2, k=3]`	`[sid=lo, SID=hi]`	`[m=ok]`	`[n=, m=ok]`	`[n=cafÃ©, m=ok]`	`[naÃ¯ve=v, m=ok]`	`[n=xxx...xxx…<4096 chars>]`	`[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]`	`[a=1, j=\x01\x01\x01...\x01\x01\x01…<4096 chars>, b=2]`	`[Partitioned=false, m=ok]`	`[n\0x=v, m=ok]`	`[a=1, \0b=2, c=3]`	`[n=v, m=ok]`	`[n=ð\x9f¤\x96, m=ok]`	`[n=%F0%9F%A4%96, m=ok]`	`[token[]=nested, m=ok]`	`[sess[k]=v, m=ok]`	`[data={"testdata":"JSON"}, m=ok]`	`[data=[nested], m=ok]`	`[m=ok]`	`[<script>=empty, m=ok]`	`[data=<img src=x />, m=ok]`	`[truthy=yes, m=ok]`	`∅`	`∅`	`[\0=, m=ok]`
rust/kekse (lenient)	`[n=v]`	`[n=a b]`	`[m=ok] ⚠️`	`[m=ok] ⚠️`	`[m=ok] ⚠️`	`[m=ok] ⚠️`	`[m=ok] ⚠️`	`[n=%4, m=ok]`	`[m=ok] ⚠️`	`n/a`	`[n=a, evil=1]`	`[n=v, m=w]`	`[n=v] ⚠️`	`[n=a=b]`	`[other=x, SID=deadbeef]`	`[n=v]`	`[a=1, b=2]`	`[n=a, SID=x]`	`n/a`	`∅ ⚠️`	`[k=1, k=2, k=3]`	`[sid=lo, SID=hi]`	`[m=ok] ⚠️`	`[n=, m=ok]`	`[m=ok] ⚠️`	`[m=ok] ⚠️`	`[n=xxx...xxx…<4096 chars>]`	`[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]`	`[a=1, b=2] ⚠️`	`[Partitioned=false, m=ok]`	`[m=ok] ⚠️`	`[a=1, c=3] ⚠️`	`[n=v, m=ok]`	`[m=ok] ⚠️`	`[n=🤖, m=ok]`	`[m=ok] ⚠️`	`[m=ok] ⚠️`	`[m=ok] ⚠️`	`[data=[nested], m=ok]`	`[m=ok] ⚠️`	`[m=ok] ⚠️`	`[data=<img src=x />, m=ok]`	`[truthy=yes, m=ok]`	`∅ ⚠️`	`∅ ⚠️`	`[m=ok] ⚠️`
rust/kekse (strict)	`[n=v]`	`∅ ⚠️`	`[m=ok] ⚠️`	`[m=ok] ⚠️`	`[m=ok] ⚠️`	`[m=ok] ⚠️`	`[m=ok] ⚠️`	`[n=%4, m=ok]`	`[m=ok] ⚠️`	`n/a`	`[n=a, evil=1]`	`[n=v, m=w]`	`[n=v] ⚠️`	`[n=a=b]`	`[other=x, SID=deadbeef]`	`[n=v]`	`[a=1, b=2]`	`[n=a, SID=x]`	`n/a`	`∅ ⚠️`	`[k=1, k=2, k=3]`	`[sid=lo, SID=hi]`	`[m=ok] ⚠️`	`[n=, m=ok]`	`[m=ok] ⚠️`	`[m=ok] ⚠️`	`[n=xxx...xxx…<4096 chars>]`	`[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]`	`[a=1, b=2] ⚠️`	`[Partitioned=false, m=ok]`	`[m=ok] ⚠️`	`[a=1, c=3] ⚠️`	`[n=v, m=ok]`	`[m=ok] ⚠️`	`[n=🤖, m=ok]`	`[m=ok] ⚠️`	`[m=ok] ⚠️`	`[m=ok] ⚠️`	`[data=[nested], m=ok]`	`[m=ok] ⚠️`	`[m=ok] ⚠️`	`[m=ok] ⚠️`	`[truthy=yes, m=ok]`	`∅ ⚠️`	`∅ ⚠️`	`[m=ok] ⚠️`
rust/kekse (fail-hard)	`[n=v]`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`[n=%4, m=ok]`	`❌`	`n/a`	`[n=a, evil=1]`	`[n=v, m=w]`	`❌`	`[n=a=b]`	`[other=x, SID=deadbeef]`	`[n=v]`	`[a=1, b=2]`	`[n=a, SID=x]`	`n/a`	`❌`	`[k=1, k=2, k=3]`	`[sid=lo, SID=hi]`	`❌`	`[n=, m=ok]`	`❌`	`❌`	`[n=xxx...xxx…<4096 chars>]`	`[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]`	`❌`	`[Partitioned=false, m=ok]`	`❌`	`❌`	`[n=v, m=ok]`	`❌`	`[n=🤖, m=ok]`	`❌`	`❌`	`❌`	`[data=[nested], m=ok]`	`❌`	`❌`	`❌`	`[truthy=yes, m=ok]`	`❌`	`❌`	`❌`
rust/cookie	`[n=v]`	`[n=a b]`	`[n=a\0b, m=ok]`	`[n=a\r\nb, m=ok]`	`[n=a\x01b, m=ok]`	`[n="v, m=ok]`	`[n=a"b, m=ok]`	`[n=%4, m=ok]`	`[m=ok] ⚠️`	`n/a`	`[n=a, evil=1]`	`[n=v, m=w]`	`[n=v] ⚠️`	`[n=a=b]`	`[other=x, SID=deadbeef]`	`[n=v]`	`[a=1, b=2]`	`[n=a, SID=x]`	`n/a`	`[a=1, SID=x]`	`[k=1, k=2, k=3]`	`[sid=lo, SID=hi]`	`[m=ok] ⚠️`	`[n=, m=ok]`	`[n=café, m=ok]`	`[naïve=v, m=ok]`	`[n=xxx...xxx…<4096 chars>]`	`[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]`	`[a=1, j=\x01\x01\x01...\x01\x01\x01…<4096 chars>, b=2]`	`[Partitioned=false, m=ok]`	`[n\0x=v, m=ok]`	`[a=1, \0b=2, c=3]`	`[n=v, m=ok]`	`[n=🤖, m=ok]`	`[n=🤖, m=ok]`	`[token[]=nested, m=ok]`	`[sess[k]=v, m=ok]`	`[data={"testdata":"JSON"}, m=ok]`	`[data=[nested], m=ok]`	`[m=ok] ⚠️`	`[<script>=empty, m=ok]`	`[data="<img src=x />", m=ok]`	`[truthy=yes, m=ok]`	`∅ ⚠️`	`∅ ⚠️`	`[\0=, m=ok]`
rust/biscotti	`[n=v]`	`[n=a b]`	`[n=a\0b, m=ok]`	`[n=a\r\nb, m=ok]`	`[n=a\x01b, m=ok]`	`[n="v, m=ok]`	`[n=a"b, m=ok]`	`[n=%4, m=ok]`	`❌`	`n/a`	`[n=a, evil=1]`	`[n=v, m=w]`	`❌`	`[n=a=b]`	`[other=x, SID=deadbeef]`	`[n=v]`	`[a=1, b=2]`	`[n=a, SID=x]`	`n/a`	`[a=1, SID=x]`	`[k=1, k=2, k=3]`	`[sid=lo, SID=hi]`	`❌`	`[n=, m=ok]`	`[n=café, m=ok]`	`[naïve=v, m=ok]`	`[n=xxx...xxx…<4096 chars>]`	`[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]`	`[a=1, j=\x01\x01\x01...\x01\x01\x01…<4096 chars>, b=2]`	`[Partitioned=false, m=ok]`	`[n\0x=v, m=ok]`	`[a=1, \0b=2, c=3]`	`[n=v, m=ok]`	`[n=🤖, m=ok]`	`[n=🤖, m=ok]`	`[token[]=nested, m=ok]`	`[sess[k]=v, m=ok]`	`[data={"testdata":"JSON"}, m=ok]`	`[data=[nested], m=ok]`	`❌`	`[<script>=empty, m=ok]`	`[data="<img src=x />", m=ok]`	`[truthy=yes, m=ok]`	`❌`	`❌`	`[\0=, m=ok]`
rust/axum-extra	`[n=v]`	`[n=a b]`	`❌`	`❌`	`❌`	`[m=ok, n="v]`	`[m=ok, n=a"b]`	`[m=ok, n=%4]`	`[m=ok]`	`n/a`	`[evil=1, n=a]`	`[m=w, n=v]`	`[n=v]`	`[n=a=b]`	`[SID=deadbeef, other=x]`	`[n=v]`	`[a=1, b=2]`	`[SID=x, n=a]`	`n/a`	`[a=1, SID=x]`	`[k=3]`	`[SID=hi, sid=lo]`	`[m=ok]`	`[m=ok, n=]`	`∅`	`∅`	`[n=xxx...xxx…<4096 chars>]`	`[k0=v0, k1=v1, k10=v10, k11=v11, …(+17 more)]`	`❌`	`[Partitioned=false, m=ok]`	`❌`	`❌`	`[m=ok, n=v]`	`∅`	`[m=ok, n=🤖]`	`[m=ok, token[]=nested]`	`[m=ok, sess[k]=v]`	`[data={"testdata":"JSON"}, m=ok]`	`[data=[nested], m=ok]`	`[m=ok]`	`[<script>=empty, m=ok]`	`[data="<img src=x />", m=ok]`	`[m=ok, truthy=yes]`	`∅`	`∅`	`❌`
python/SimpleCookie	`[n=v]`	`∅`	`∅`	`∅`	`∅`	`∅`	`∅`	`[n=%4, m=ok]`	`[n=%FF, m=ok]`	`∅`	`[n=a, evil=1]`	`[n=v]`	`∅`	`[n=a=b]`	`[other=x, SID=deadbeef]`	`[n=v]`	`[a=1]`	`[n=a]`	`∅`	`[a=1,, SID=x]`	`[k=3]`	`[sid=lo, SID=hi]`	`∅`	`[n=, m=ok]`	`∅`	`∅`	`[n=xxx...xxx…<4096 chars>]`	`[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]`	`[a=1]`	`[Partitioned=false, m=ok]`	`∅`	`[a=1]`	`[n=v, m=ok]`	`∅`	`[n=%F0%9F%A4%96, m=ok]`	`∅`	`∅`	`∅`	`[data=[nested], m=ok]`	`∅`	`❌`	`[data=<img src=x />, m=ok]`	`[truthy=yes, m=ok]`	`∅`	`❌`	`∅`
python/Werkzeug	`[n=v]`	`[n=a b]`	`[n=a\0b, m=ok]`	`[a\r\nb=, m=ok]`	`[n=a\x01b, m=ok]`	`[n="v, m=ok]`	`[n=a"b, m=ok]`	`[n=%4, m=ok]`	`[n=%FF, m=ok]`	`❌`	`[n=a, evil=1]`	`[n=v, m=w]`	`[flag=, n=v]`	`[n=a=b]`	`[other=x, SID=deadbeef]`	`[n=v]`	`[a=1, b=2]`	`[n=a, SID=x]`	`❌`	`[a=1, SID=x]`	`[k=1, k=2, k=3]`	`[sid=lo, SID=hi]`	`[m=ok]`	`[n=, m=ok]`	`[n=café, m=ok]`	`[naïve=v, m=ok]`	`[n=xxx...xxx…<4096 chars>]`	`[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]`	`[a=1, j=\x01\x01\x01...\x01\x01\x01…<4096 chars>, b=2]`	`[Partitioned=false, m=ok]`	`[n\0x=v, m=ok]`	`[a=1, \0b=2, c=3]`	`[n=v, m=ok]`	`[n=🤖, m=ok]`	`[n=%F0%9F%A4%96, m=ok]`	`[token[]=nested, m=ok]`	`[sess[k]=v, m=ok]`	`[data={"testdata":"JSON"}, m=ok]`	`[data=[nested], m=ok]`	`[<script>=, m=ok]`	`[<script>=empty, m=ok]`	`[data=<img src=x />, m=ok]`	`[truthy=yes, m=ok]`	`∅`	`∅`	`[\0=, m=ok]`
python/mitmproxy	`[n = v ]`	`[n=a b]`	`[n=a\0b, m=ok]`	`[n=a\r\nb, m=ok]`	`[n=a\x01b, m=ok]`	`[n=v; m=ok]`	`[n=a"b, m=ok]`	`[n=%4, m=ok]`	`[n=%FF, m=ok]`	`[n=aÿb]`	`[n=a, evil=1]`	`[n=v, m=w]`	`[flag=, n=v]`	`[n=a=b]`	`[other=x, SID=deadbeef]`	`[n=v]`	`[a=1, b=2]`	`[n=a, SID=x]`	`[bad=café, good=1, SID=deadbeef]`	`[a=1, SID=x]`	`[k=1, k=2, k=3]`	`[sid=lo, SID=hi]`	`[=v, m=ok]`	`[n=, m=ok]`	`[n=cafÃ©, m=ok]`	`[naÃ¯ve=v, m=ok]`	`[n=xxx...xxx…<4096 chars>]`	`[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]`	`[a=1, j=\x01\x01\x01...\x01\x01\x01…<4096 chars>, b=2]`	`[Partitioned=false, m=ok]`	`[n\0x=v, m=ok]`	`[a=1, \0b=2, c=3]`	`[n\t=\tv\t, m=ok]`	`[n=ð\x9f¤\x96, m=ok]`	`[n=%F0%9F%A4%96, m=ok]`	`[token[]=nested, m=ok]`	`[sess[k]=v, m=ok]`	`[data={"testdata":"JSON"}, m=ok]`	`[data=[nested], m=ok]`	`[<script>=, m=ok]`	`[<script>=empty, m=ok]`	`[data=<img src=x />, m=ok]`	`[truthy=yes, m=ok]`	`∅`	`[==]`	`[\0=, m=ok]`
node/cookie	`[n=v]`	`[n=a b]`	`[n=a\0b, m=ok]`	`[n=a\r\nb, m=ok]`	`[n=a\x01b, m=ok]`	`[n="v, m=ok]`	`[n=a"b, m=ok]`	`[n=%4, m=ok]`	`[n=%FF, m=ok]`	`[n=aÿb]`	`[n=a, evil=1]`	`[n=v, m=w]`	`[n=v]`	`[n=a=b]`	`[other=x, SID=deadbeef]`	`[n=v]`	`[a=1, b=2]`	`[n=a, SID=x]`	`[bad=café, good=1, SID=deadbeef]`	`[a=1, SID=x]`	`[k=1]`	`[sid=lo, SID=hi]`	`[=v, m=ok]`	`[n=, m=ok]`	`[n=cafÃ©, m=ok]`	`[naÃ¯ve=v, m=ok]`	`[n=xxx...xxx…<4096 chars>]`	`[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]`	`[a=1, j=\x01\x01\x01...\x01\x01\x01…<4096 chars>, b=2]`	`[Partitioned=false, m=ok]`	`[n\0x=v, m=ok]`	`[a=1, \0b=2, c=3]`	`[n=v, m=ok]`	`[n=ð\x9f¤\x96, m=ok]`	`[n=🤖, m=ok]`	`[token[]=nested, m=ok]`	`[sess[k]=v, m=ok]`	`[data={"testdata":"JSON"}, m=ok]`	`[data=[nested], m=ok]`	`[m=ok]`	`[<script>=empty, m=ok]`	`[data=<img src=x />, m=ok]`	`[truthy=yes, m=ok]`	`∅`	`[==]`	`[\0=, m=ok]`
node/universal-cookie	`[n=v]`	`[n=v]`	`[n=a b]`	`[n=a\0b, m=ok]`	`[n=a\r\nb, m=ok]`	`[n=a\x01b, m=ok]`	`[n="v, m=ok]`	`[n=a"b, m=ok]`	`[n=%4, m=ok]`	`[n=%FF, m=ok]`	`[n=aÿb]`	`[n=a, evil=1]`	`[n=v, m=w]`	`[n=v]`	`[n=a=b]`	`[other=x, SID=deadbeef]`	`[n=v]`	`[a=1, b=2]`	`[n=a, SID=x]`	`[bad=café, good=1, SID=deadbeef]`	`[a=1, SID=x]`	`[k=1]`	`[sid=lo, SID=hi]`	`[=v, m=ok]`	`[n=, m=ok]`	`[n=cafÃ©, m=ok]`	`[naÃ¯ve=v, m=ok]`	`[n=xxx...xxx…<4096 chars>]`	`[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]`	`[a=1, j=\x01\x01\x01...\x01\x01\x01…<4096 chars>, b=2]`	`[Partitioned=false, m=ok]`	`[n\0x=v, m=ok]`	`[a=1, \0b=2, c=3]`	`[n=v, m=ok]`	`[n=ð\x9f¤\x96, m=ok]`	`[n=🤖, m=ok]`	`[token[]=nested, m=ok]`	`[sess[k]=v, m=ok]`	`[data={"testdata":"JSON"}, m=ok]`	`[data=[nested], m=ok]`	`[m=ok]`	`[<script>=empty, m=ok]`	`[data="<img src=x />", m=ok]`	`[truthy=yes, m=ok]`	`∅`	`[==]`
node/js-cookie	`[ n = v ]`	`[n=a b]`	`[n=a\0b, m=ok]`	`[n=a\r\nb, m=ok]`	`[n=a\x01b, m=ok]`	`[n=, m=ok]`	`[n=a"b, m=ok]`	`[n=%4, m=ok]`	`[m=ok]`	`[n=aÿb]`	`[n=a;evil=1]`	`[n=v;;;m=w]`	`[flag=, n=v]`	`[n=a=b]`	`[other=x, SID=deadbeef]`	`[n=v]`	`[a=1, =, b=2]`	`[n=a;, SID=x]`	`[bad=café, good=1, SID=deadbeef]`	`[a=1, SID=x]`	`[k=1]`	`[sid=lo, SID=hi]`	`[=v, m=ok]`	`[n=, m=ok]`	`[n=cafÃ©, m=ok]`	`[naÃ¯ve=v, m=ok]`	`[n=xxx...xxx…<4096 chars>]`	`[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]`	`[a=1, j=\x01\x01\x01...\x01\x01\x01…<4096 chars>, b=2]`	`[Partitioned=false, m=ok]`	`[n\0x=v, m=ok]`	`[a=1, \0b=2, c=3]`	`[\tn\t=\tv\t, m=ok]`	`[n=ð\x9f¤\x96, m=ok]`	`[n=🤖, m=ok]`	`[token[]=nested, m=ok]`	`[sess[k]=v, m=ok]`	`[data={"testdata":"JSON"}, m=ok]`	`[data=[nested], m=ok]`	`[<script>=, m=ok]`	`[<script>=empty, m=ok]`	`[data=<img src=x />, m=ok]`	`[truthy=yes, m=ok]`	`[=]`	`[==]`	`[\0=, m=ok]`
go/net/http	`❌`	`[n=a b]`	`❌`	`❌`	`❌`	`❌`	`❌`	`[n=%4, m=ok]`	`[n=%FF, m=ok]`	`❌`	`[n=a, evil=1]`	`❌`	`❌`	`[n=a=b]`	`[other=x, SID=deadbeef]`	`[n=v]`	`❌`	`❌`	`❌`	`[a=1, SID=x]`	`[k=1, k=2, k=3]`	`[sid=lo, SID=hi]`	`❌`	`[n=, m=ok]`	`❌`	`❌`	`[n=xxx...xxx…<4096 chars>]`	`[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]`	`❌`	`[Partitioned=false, m=ok]`	`❌`	`❌`	`❌`	`❌`	`[n=%F0%9F%A4%96, m=ok]`	`❌`	`❌`	`❌`	`[data=[nested], m=ok]`	`❌`	`❌`	`[data=<img src=x />, m=ok]`	`[truthy=yes, m=ok]`	`❌`	`❌`	`❌`
dotnet/Microsoft.Net.Http.Headers	`❌`	`❌`	`[m=ok]`	`[m=ok]`	`[m=ok]`	`[n=, m=ok]`	`[m=ok]`	`[n=%4, m=ok]`	`[n=%FF, m=ok]`	`❌`	`[n=a, evil=1]`	`[n=v, m=w]`	`[n=v]`	`[n=a=b]`	`[other=x, SID=deadbeef]`	`[n=v]`	`[a=1, b=2]`	`[n=a, SID=x]`	`[good=1, SID=deadbeef]`	`❌`	`[k=1, k=2, k=3]`	`[sid=lo, SID=hi]`	`[m=ok]`	`[n=, m=ok]`	`[m=ok]`	`[m=ok]`	`[n=xxx...xxx…<4096 chars>]`	`[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]`	`[a=1, b=2]`	`[Partitioned=false, m=ok]`	`[m=ok]`	`[a=1, c=3]`	`[m=ok]`	`[m=ok]`	`[n=%F0%9F%A4%96, m=ok]`	`[m=ok]`	`[m=ok]`	`[m=ok]`	`[data=[nested], m=ok]`	`[m=ok]`	`[m=ok]`	`[m=ok]`	`[truthy=yes, m=ok]`	`❌`	`❌`	`[m=ok]`
php/$_COOKIE	`[n__= v ]`	`[n=a b]`	`[n=a]`	`❌`	`[n=a\x01b, m=ok]`	`[n="v, m=ok]`	`[n=a"b, m=ok]`	`[n=%4, m=ok]`	`[n=ÿ, m=ok]`	`[n=aÿb]`	`[n=a, evil=1]`	`[n=v, m=w]`	`[flag=, n=v]`	`[n=a=b]`	`[other=x, SID=deadbeef]`	`[n=v]`	`[a=1, b=2]`	`[n=a, SID=x]`	`[bad=café, good=1, SID=deadbeef]`	`[a=1, SID=x]`	`[k=1]`	`[sid=lo, SID=hi]`	`[m=ok]`	`[n=, m=ok]`	`[n=cafÃ©, m=ok]`	`[naÃ¯ve=v, m=ok]`	`[n=xxx...xxx…<4096 chars>]`	`[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]`	`[a=1, j=\x01\x01\x01...\x01\x01\x01…<4096 chars>, b=2]`	`[Partitioned=false, m=ok]`	`[n=]`	`[a=1]`	`[n\t=\tv\t, m=ok]`	`[n=ð\x9f¤\x96, m=ok]`	`[n=ð\x9f¤\x96, m=ok]`	`[token=⟨array⟩["nested"], m=ok]`	`[sess=⟨object⟩{"k":"v"}, m=ok]`	`[data={"testdata":"JSON"}, m=ok]`	`[data=[nested], m=ok]`	`[<script>=, m=ok]`	`[<script>=empty, m=ok]`	`[data="<img src=x />", m=ok]`	`[truthy=yes, m=ok]`	`∅`	`∅`	`∅`
nginx/$cookie_<name>	`[n=v]`	`[n=a b]`	`❌`	`❌`	`[n=a\x01b, m=ok]`	`[n="v, m=ok]`	`[n=a"b, m=ok]`	`[n=%4, m=ok]`	`[n=%FF, m=ok]`	`[n=aÿb]`	`[n=a, evil=1]`	`[n=v, m=w]`	`[n=v]`	`[n=a=b]`	`[other=x, SID=deadbeef]`	`[n=v]`	`[a=1, b=2]`	`[n=a, SID=x]`	`[bad=café, good=1, SID=deadbeef]`	`[a=1, SID=x]`	`[k=1]`	`[sid=lo, SID=lo]`	`[m=ok]`	`[n=, m=ok]`	`[n=cafÃ©, m=ok]`	`[naÃ¯ve=v, m=ok]`	`[n=xxx...xxx…<4096 chars>]`	`[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]`	`[a=1, j=\x01\x01\x01...\x01\x01\x01…<4096 chars>, b=2]`	`[Partitioned=false, m=ok]`	`❌`	`❌`	`[m=ok]`	`[n=ð\x9f¤\x96, m=ok]`	`[n=%F0%9F%A4%96, m=ok]`	`[token[]=nested, m=ok]`	`[sess[k]=v, m=ok]`	`[data={"testdata":"JSON"}, m=ok]`	`[data=[nested], m=ok]`	`[m=ok]`	`[<script>=empty, m=ok]`	`[data="<img src=x />", m=ok]`	`[truthy=yes, m=ok]`	`∅`	`∅`	`❌`
nginx/lua-resty-cookie	`[n =]`	`[n=a]`	`❌`	`❌`	`[m=ok, n=a\x01b]`	`[m=ok, n="v]`	`[m=ok, n=a"b]`	`[m=ok, n=%4]`	`[m=ok, n=%FF]`	`[n=aÿb]`	`[evil=1, n=a]`	`[;;m=w, n=v]`	`[flag; n=v]`	`[n=a=b]`	`[SID=deadbeef, other=x]`	`[n=v]`	`[; b=2, a=1]`	`[; SID=x, n=a]`	`[SID=deadbeef, bad=café, good=1]`	`[SID=x, a=1,]`	`[k=3]`	`[SID=hi, sid=lo]`	`[=v, m=ok]`	`[m=ok, n=]`	`[m=ok, n=cafÃ©]`	`[m=ok, naÃ¯ve=v]`	`[n=xxx...xxx…<4096 chars>]`	`[k0=v0, k1=v1, k10=v10, k11=v11, …(+17 more)]`	`[a=1, b=2, j=\x01\x01\x01...\x01\x01\x01…<4096 chars>]`	`[Partitioned=false, m=ok]`	`❌`	`❌`	`[n\t=, v\t; m=ok]`	`[m=ok, n=ð\x9f¤\x96]`	`[m=ok, n=%F0%9F%A4%96]`	`[m=ok, token[]=nested]`	`[m=ok, sess[k]=v]`	`[data={"testdata":"JSON"}, m=ok]`	`[data=[nested], m=ok]`	`[<script>; m=ok]`	`[<script>=empty, m=ok]`	`[/>"; m=ok, data="<img, src=x]`	`[m=ok, truthy=yes]`	`[=]`	`[==]`	`❌`
nginx/proxy	`≠ n = v`	`≡`	`❌`	`❌`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`❌`	`❌`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`❌`
java/Tomcat RFC6265	`[n=v]`	`∅`	`[m=ok]`	`[m=ok]`	`[m=ok]`	`[n=v, m=ok]`	`[m=ok]`	`[n=%4, m=ok]`	`[n=%FF, m=ok]`	`[n=aÿb]`	`[n=a, evil=1]`	`[n=v, m=w]`	`[flag=, n=v]`	`[n=a=b]`	`[other=x, SID=deadbeef]`	`[n=v]`	`[a=1, b=2]`	`[n=a, SID=x]`	`[bad=café, good=1, SID=deadbeef]`	`∅`	`[k=1, k=2, k=3]`	`[sid=lo, SID=hi]`	`[m=ok]`	`[n=, m=ok]`	`[n=cafÃ©, m=ok]`	`[m=ok]`	`[n=xxx...xxx…<4096 chars>]`	`[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]`	`[a=1, b=2]`	`[Partitioned=false, m=ok]`	`[m=ok]`	`[a=1, c=3]`	`[n=v, m=ok]`	`[n=ð\x9f¤\x96, m=ok]`	`[n=%F0%9F%A4%96, m=ok]`	`[m=ok]`	`[m=ok]`	`[m=ok]`	`[data=[nested], m=ok]`	`[m=ok]`	`[m=ok]`	`[m=ok]`	`[truthy=yes, m=ok]`	`∅`	`∅`	`[m=ok]`
java/Tomcat legacy	`[n=v]`	`[n=a]`	`❌`	`❌`	`❌`	`∅`	`[n=a, m=ok]`	`[n=%4, m=ok]`	`[n=%FF, m=ok]`	`❌`	`[n=a, evil=1]`	`[n=v, m=w]`	`[n=v]`	`[n=a]`	`[other=x, SID=deadbeef]`	`[n=v]`	`[a=1, b=2]`	`[n=a, SID=x]`	`❌`	`[a=1, SID=x]`	`[k=1, k=2, k=3]`	`[sid=lo, SID=hi]`	`[m=ok]`	`[m=ok]`	`❌`	`❌`	`[n=xxx...xxx…<4096 chars>]`	`[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]`	`❌`	`[Partitioned=false, m=ok]`	`❌`	`❌`	`[n=v, m=ok]`	`❌`	`[n=%F0%9F%A4%96, m=ok]`	`[m=ok]`	`[m=ok]`	`[m=ok]`	`[m=ok]`	`[m=ok]`	`[m=ok]`	`[data=<img src=x />, m=ok]`	`[truthy=yes, m=ok]`	`∅`	`∅`	`❌`
java/Jakarta RESTEasy	`[n=v]`	`[n=a b]`	`[n=a\0b, m=ok]`	`[n=a\r\nb, m=ok]`	`[n=a\x01b, m=ok]`	`[n="v, m=ok]`	`[n=a"b, m=ok]`	`[n=%4, m=ok]`	`[n=%FF, m=ok]`	`[n=aÿb]`	`[n=a, evil=1]`	`[n=v, m=w]`	`[flag=, n=v]`	`[n=a=b]`	`[other=x, SID=deadbeef]`	`[n=v]`	`[a=1, b=2]`	`[n=a, SID=x]`	`[bad=café, good=1, SID=deadbeef]`	`[a=1]`	`[k=1, k=2, k=3]`	`[sid=lo, SID=hi]`	`[=v, m=ok]`	`[n=, m=ok]`	`[n=cafÃ©, m=ok]`	`[naÃ¯ve=v, m=ok]`	`[n=xxx...xxx…<4096 chars>]`	`[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]`	`[a=1, j=, b=2]`	`[Partitioned=false, m=ok]`	`[n\0x=v, m=ok]`	`[a=1, b=2, c=3]`	`[n=v, m=ok]`	`[n=ð\x9f¤\x96, m=ok]`	`[n=%F0%9F%A4%96, m=ok]`	`[token[]=nested, m=ok]`	`[sess[k]=v, m=ok]`	`[data={"testdata":"JSON"}, m=ok]`	`[data=[nested], m=ok]`	`[<script>=, m=ok]`	`[<script>=empty, m=ok]`	`[data=<img src=x />, m=ok]`	`[truthy=yes, m=ok]`	`[=]`	`[==]`	`[=, m=ok]`
java/Jakarta Jersey	`[n=v]`	`[n=a b]`	`[n=a\0b, m=ok]`	`[n=a\r\nb, m=ok]`	`[n=a\x01b, m=ok]`	`[n="v, m=ok]`	`[n=a"b, m=ok]`	`[n=%4, m=ok]`	`[n=%FF, m=ok]`	`[n=aÿb]`	`[n=a, evil=1]`	`[n=v, m=w]`	`[flag=, n=v]`	`[n=a=b]`	`[other=x, SID=deadbeef]`	`[n=v]`	`[a=1, b=2]`	`[n=a, SID=x]`	`[bad=café, good=1, SID=deadbeef]`	`[a=1]`	`[k=1, k=2, k=3]`	`[sid=lo, SID=hi]`	`[=v, m=ok]`	`[n=, m=ok]`	`[n=cafÃ©, m=ok]`	`[naÃ¯ve=v, m=ok]`	`[n=xxx...xxx…<4096 chars>]`	`[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]`	`[a=1, j=, b=2]`	`[Partitioned=false, m=ok]`	`[n\0x=v, m=ok]`	`[a=1, b=2, c=3]`	`[n=v, m=ok]`	`[n=ð\x9f¤\x96, m=ok]`	`[n=%F0%9F%A4%96, m=ok]`	`[token[]=nested, m=ok]`	`[sess[k]=v, m=ok]`	`[data={"testdata":"JSON"}, m=ok]`	`[data=[nested], m=ok]`	`[<script>=, m=ok]`	`[<script>=empty, m=ok]`	`[data=<img src=x />, m=ok]`	`[truthy=yes, m=ok]`	`[=]`	`[==]`	`[=, m=ok]`

Response Set-Cookie: parsers

tool	attr-unknown	attr-unknown-bare	attr-bad-maxage	attr-garbage-samesite	attr-valued-flag	attr-duplicate	resp-partitioned-secure	resp-partitioned-bare	resp-partitioned-valued	resp-partitioned-dup	prefix-secure-ok	prefix-secure-missing	prefix-host-ok	prefix-host-missing-secure	prefix-host-domain	prefix-host-path	prefix-host-case	prefix-host-case-conformant	resp-partitioned-samesite-none	prefix-host-partitioned	resp-partitioned-domain	resp-partitioned-false	resp-partitioned-true	resp-partitioned-case	resp-partitioned-name	resp-encoded-semicolon-attr	resp-quoted-attr-text	resp-partitioned-leading	resp-samesite-strict	resp-samesite-lax	resp-samesite-none-bare	resp-samesite-none-secure	resp-samesite-case	resp-samesite-empty	date-imf-fixdate	date-rfc850	date-asctime	date-no-weekday	date-wrong-weekday	date-nonsense-weekday	date-no-timezone	date-reordered	date-2digit-year-imf-shape	date-trailing-comment	date-unix	date-garbage	date-impossible-day	date-year-pre-1601	date-minute-out-of-range	date-second-out-of-range	date-iso8601	date-us-slash	date-eu-dotted	date-epoch	date-2digit-year-69	date-2digit-year-70	date-year-1601-boundary	date-hour-out-of-range	date-1-digit-day	date-month-case	date-month-overlong	date-year-trailing-alpha	date-5-digit-year	date-missing-year	date-empty	date-zone-offset	date-tab-delims	date-first-token-wins	domain-supercookie-tld	domain-supercookie-icann	domain-registrable	domain-punycode	domain-utf8	domain-emoji-utf8	domain-emoji-punycode	domain-malformed-punycode	domain-not-a-host-name	domain-dup-last-wins	domain-dup-valid-then-invalid	path-file-uri	path-empty	path-dot	path-overlong-1025	resp-all-attrs	resp-crlf	resp-ws-surrounding	resp-empty-value	resp-ctl-nul	resp-ctl-other	resp-quote-interior	resp-non-ascii	resp-nameless-bare	resp-nameless-eq	resp-non-ascii-name	resp-space-in-name	resp-del-byte	attr-nul-name	attr-nul-value	resp-array-name	resp-json-value	resp-bracket-value	resp-quoted-html-value	resp-quoted-pair-flag
payload	`SID=abc; Priority=High`	`SID=abc; Priority`	`SID=abc; Max-Age=banana`	`SID=abc; SameSite=Bogus`	`SID=abc; Secure=1`	`SID=abc; Path=/a; Path=/b`	`SID=abc; Partitioned; Secure`	`SID=abc; Partitioned`	`SID=abc; Partitioned=1`	`SID=abc; Partitioned; Partit…<41>`	`__Secure-SID=abc; Secure`	`__Secure-SID=abc`	`__Host-SID=abc; Secure; Path=/`	`__Host-SID=abc; Path=/`	`__Host-SID=abc; Secure; Path…<50>`	`__Host-SID=abc; Secure; Path=/app`	`__host-SID=abc`	`__host-SID=abc; Secure; Path=/`	`SID=abc; SameSite=None; Secu…<43>`	`__Host-SID=abc; Secure; Path…<43>`	`SID=abc; Secure; Domain=exam…<48>`	`SID=abc; Secure; Partitioned=false`	`SID=abc; Secure; Partitioned=true`	`SID=abc; Secure; pArTiTiOnEd`	`Partitioned=false`	`SID=abc%3B%20Partitioned; Secure`	`SID="abc; Partitioned"; Secure`	`Partitioned; SID=abc`	`SID=abc; SameSite=Strict`	`SID=abc; SameSite=Lax`	`SID=abc; SameSite=None`	`SID=abc; SameSite=None; Secure`	`SID=abc; SameSite=lAx`	`SID=abc; SameSite=`	`SID=abc; Expires=Sun, 06 Nov…<46>`	`SID=abc; Expires=Sunday, 06-…<47>`	`SID=abc; Expires=Sun Nov 6 …<41>`	`SID=abc; Expires=06 Nov 1994…<41>`	`SID=abc; Expires=Mon, 06 Nov…<46>`	`SID=abc; Expires=Birthday, 0…<51>`	`SID=abc; Expires=Sun, 06 Nov…<42>`	`SID=abc; Expires=08:49:37 19…<37>`	`SID=abc; Expires=Sun, 06 Nov…<44>`	`SID=abc; Expires=Sun, 06 Nov…<52>`	`SID=abc; Expires=Sun Nov 6 …<45>`	`SID=abc; Expires=not-a-date`	`SID=abc; Expires=Sun, 31 Feb…<46>`	`SID=abc; Expires=Sun, 06 Nov…<46>`	`SID=abc; Expires=Sun, 06 Nov…<46>`	`SID=abc; Expires=Sun, 06 Nov…<46>`	`SID=abc; Expires=1994-11-06T…<37>`	`SID=abc; Expires=11/06/1994 08:49:37`	`SID=abc; Expires=06.11.1994 08:49:37`	`SID=abc; Expires=784108177`	`SID=abc; Expires=Tue, 01 Jan…<44>`	`SID=abc; Expires=Thu, 01 Jan…<44>`	`SID=abc; Expires=Mon, 01 Jan…<46>`	`SID=abc; Expires=Sun, 06 Nov…<46>`	`SID=abc; Expires=Sun, 6 Nov …<45>`	`SID=abc; Expires=Sun, 06 NOV…<46>`	`SID=abc; Expires=06 Novembre…<42>`	`SID=abc; Expires=06 Nov 1994…<39>`	`SID=abc; Expires=06 Nov 1994…<38>`	`SID=abc; Expires=Sun, 06 Nov…<41>`	`SID=abc; Expires=`	`SID=abc; Expires=Sun, 06 Nov…<51>`	`SID=abc; Expires=Sun,\t06\tN…<51>`	`SID=abc; Expires=07:00:00 08…<46>`	`SID=abc; Domain=.com`	`SID=abc; Domain=co.uk`	`SID=abc; Domain=example.co.uk`	`SID=abc; Domain=xn--mnchen-3ya.de`	`SID=abc; Domain=münchen.de`	`SID=abc; Domain=🍪.eu`	`SID=abc; Domain=xn--hj8h.eu`	`SID=abc; Domain=xn--`	`SID=abc; Domain=ex_ample.com`	`SID=abc; Domain=a.example.co…<51>`	`SID=abc; Domain=valid.exampl…<46>`	`SID=abc; Path=file:///etc/passwd`	`SID=abc; Path=`	`SID=abc; Path=.`	`SID=abc; Path=/aaaaaaaaaaaaa…<1039>`	`SID=abc; Path=/p; Domain=exa…<93>`	`SID=a\r\nb`	`SID = v`	`SID=`	`SID=a\0b`	`SID=a\x01b`	`SID=a"b`	`SID=café`	`justvalue`	`=v`	`naïve=v`	`S ID=abc`	`SID=a\x7fb`	`SID=abc; Pa\0th=/`	`SID=abc; Path=/a\0b`	`token[]=nested`	`data={"testdata":"JSON"}`	`data=[nested]`	`data="<img src=x />"`	`"sid=surrounded-by-doublequo…<40>`
RFC (standard)	keep cookie, ignore attr (§5.2)	—	keep cookie, ignore attr (§5.2)	keep cookie, ignore attr (§5.2)	—	keep cookie, last wins (§5.2)	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	6265bis: samesite-av parses	6265bis: samesite-av parses	6265bis: None requires Secure	6265bis: None + Secure	6265bis: value is case-insensitive	keep cookie, ignore attr (§5.2)	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	—	§5.1.1: 69 → 2069	§5.1.1: 70 → 1970	§5.1.1: year ≥ 1601 is valid	§5.1.1: hour > 23 fails	§5.1.1: day is 12DIGIT	§5.1.1: month is case-insensitive	§5.1.1: month = first 3 letters	§5.1.1: non-digit year tail ignored	§5.1.1: year is 24DIGIT	§5.1.1: all four fields required	no date → ignore Expires (§5.2.1)	§5.1.1: zone tokens ignored	§5.1.1: HTAB is a delimiter	§5.1.1: first match binds each field	—	—	—	—	—	—	—	—	—	—	—	—	—	—	path-av has no length cap (§4.1.1)	—	CR/LF must not be smuggled	trim leading/trailing WSP	empty value is valid	CTL is not a cookie-octet	CTL is not a cookie-octet	DQUOTE is not a cookie-octet	non-ASCII is not a cookie-octet	no `=` → ignore the line (§5.2)	empty name — spec-gray (§5.2)	non-token name skipped	non-token name skipped	CTL is not a cookie-octet	—	—	non-token name skipped	DQUOTE is not a cookie-octet	`[` `]` are cookie-octets	—	non-token name skipped
consensus	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;Secure`	`SID=abc ;Path=/b`	`SID=abc ;Secure`	`SID=abc`	`SID=abc`	`SID=abc ;Secure`	`__Secure-SID=abc ;Secure`	`__Secure-SID=abc`	`__Host-SID=abc ;Secure;Path=/`	`__Host-SID=abc ;Path=/`	`__Host-SID=abc ;Secure;Path=/;Domain=example.com`	`__Host-SID=abc ;Secure;Path=/app`	`__host-SID=abc`	`__host-SID=abc ;Secure;Path=/`	`SID=abc ;Secure;SameSite=None`	`__Host-SID=abc ;Secure;Path=/`	`❌`	`SID=abc ;Secure`	`SID=abc ;Secure`	`SID=abc ;Secure`	`Partitioned=false`	`SID=abc%3B%20Partitioned ;Secure`	`SID="abc ;Secure`	`❌`	`SID=abc ;SameSite=Strict`	`SID=abc ;SameSite=Lax`	`SID=abc ;SameSite=None`	`SID=abc ;Secure;SameSite=None`	`SID=abc ;SameSite=Lax`	`SID=abc`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc`	`SID=abc`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`SID=abc`	`SID=abc`	`❌`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`SID=abc`	`SID=abc`	`SID=abc ;Domain=.com`	`SID=abc ;Domain=co.uk`	`SID=abc ;Domain=example.co.uk`	`SID=abc ;Domain=xn--mnchen-3ya.de`	`❌`	`❌`	`SID=abc ;Domain=xn--hj8h.eu`	`SID=abc ;Domain=xn--`	`SID=abc ;Domain=ex_ample.com`	`SID=abc ;Domain=b.example.com`	`❌`	`SID=abc ;Path=file:///etc/passwd`	`SID=abc`	`SID=abc ;Path=.`	`SID=abc ;Path=/aaa...aaa`	`❌`	`SID=a\r\nb`	`SID=v`	`SID=`	`❌`	`❌`	`SID=a"b`	`SID=cafÃ©`	`❌`	`❌`	`naÃ¯ve=v`	`S ID=abc`	`SID=a\x7fb`	`SID=abc`	`SID=abc ;Path=/a\0b`	`token[]=nested`	`data={"testdata":"JSON"}`	`data=[nested]`	`data="<img src=x />"`	`"sid=surrounded-b…<26 chars> ;Secure`
rust/kekse (lenient)	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ;Secure ⚠️`	`SID=abc ;Path=/b ⚠️`	`SID=abc ;Secure;Partitioned`	`SID=abc ;Partitioned ⚠️`	`SID=abc ;Partitioned ⚠️`	`SID=abc ;Secure;Partitioned ⚠️`	`__Secure-SID=abc ;Secure`	`__Secure-SID=abc ⚠️`	`__Host-SID=abc ;Secure;Path=/`	`__Host-SID=abc ;Path=/ ⚠️`	`__Host-SID=abc ;Secure;Path=/;Domain=example.com ⚠️`	`__Host-SID=abc ;Secure;Path=/app ⚠️`	`__host-SID=abc ⚠️`	`__host-SID=abc ;Secure;Path=/ ⚠️`	`SID=abc ;Secure;Partitioned;SameSite=None`	`__Host-SID=abc ;Secure;Partitioned;Path=/`	`SID=abc ;Secure;Partitioned;Domain=example.com`	`SID=abc ;Secure;Partitioned ⚠️`	`SID=abc ;Secure;Partitioned ⚠️`	`SID=abc ;Secure;Partitioned`	`Partitioned=false`	`SID=abc; Partitioned ;Secure`	`❌`	`❌`	`SID=abc ;SameSite=Strict`	`SID=abc ;SameSite=Lax`	`SID=abc ;SameSite=None`	`SID=abc ;Secure;SameSite=None`	`SID=abc ;SameSite=Lax`	`SID=abc ⚠️`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ;Expires=Tue, 01 Jan 2069 00:00:00 GMT`	`SID=abc ;Expires=Thu, 01 Jan 1970 00:00:00 GMT`	`SID=abc ;Expires=Mon, 01 Jan 1601 00:00:00 GMT`	`SID=abc ⚠️`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Wed, 08 Nov 2006 07:00:00 GMT`	`SID=abc ;Domain=.com`	`SID=abc ;Domain=co.uk`	`SID=abc ;Domain=example.co.uk`	`SID=abc ;Domain=xn--mnchen-3ya.de`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ;Domain=xn--hj8h.eu`	`SID=abc ;Domain=xn--`	`SID=abc ;Domain=ex_ample.com`	`SID=abc ;Domain=b.example.com ⚠️`	`SID=abc ;Domain=valid.example.com ⚠️`	`SID=abc ;Path=file:///etc/passwd`	`SID=abc ;Path=`	`SID=abc ;Path=.`	`SID=abc ;Path=/aaa...aaa`	`SID=abc ;HttpOnly;Secure;Partitioned;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`	`❌`	`SID=v`	`SID=`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc ⚠️`	`SID=abc ⚠️`	`❌`	`❌`	`data=[nested]`	`data=<img src=x />`	`❌`
rust/kekse (strict)	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ;Secure ⚠️`	`SID=abc ;Path=/b ⚠️`	`SID=abc ;Secure;Partitioned`	`SID=abc ;Partitioned ⚠️`	`SID=abc ;Partitioned ⚠️`	`SID=abc ;Secure;Partitioned ⚠️`	`__Secure-SID=abc ;Secure`	`__Secure-SID=abc ⚠️`	`__Host-SID=abc ;Secure;Path=/`	`__Host-SID=abc ;Path=/ ⚠️`	`__Host-SID=abc ;Secure;Path=/;Domain=example.com ⚠️`	`__Host-SID=abc ;Secure;Path=/app ⚠️`	`__host-SID=abc ⚠️`	`__host-SID=abc ;Secure;Path=/ ⚠️`	`SID=abc ;Secure;Partitioned;SameSite=None`	`__Host-SID=abc ;Secure;Partitioned;Path=/`	`SID=abc ;Secure;Partitioned;Domain=example.com`	`SID=abc ;Secure;Partitioned ⚠️`	`SID=abc ;Secure;Partitioned ⚠️`	`SID=abc ;Secure;Partitioned`	`Partitioned=false`	`SID=abc; Partitioned ;Secure`	`❌`	`❌`	`SID=abc ;SameSite=Strict`	`SID=abc ;SameSite=Lax`	`SID=abc ;SameSite=None`	`SID=abc ;Secure;SameSite=None`	`SID=abc ;SameSite=Lax`	`SID=abc ⚠️`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ;Expires=Mon, 01 Jan 1601 00:00:00 GMT`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ;Domain=.com`	`SID=abc ;Domain=co.uk`	`SID=abc ;Domain=example.co.uk`	`SID=abc ;Domain=xn--mnchen-3ya.de`	`SID=abc ⚠️`	`SID=abc ⚠️`	`SID=abc ;Domain=xn--hj8h.eu`	`SID=abc ;Domain=xn--`	`SID=abc ;Domain=ex_ample.com`	`SID=abc ;Domain=b.example.com ⚠️`	`SID=abc ;Domain=valid.example.com ⚠️`	`SID=abc ;Path=file:///etc/passwd`	`SID=abc ;Path=`	`SID=abc ;Path=.`	`SID=abc ;Path=/aaa...aaa`	`SID=abc ;HttpOnly;Secure;Partitioned;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`	`❌`	`SID=v`	`SID=`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc ⚠️`	`SID=abc ⚠️`	`❌`	`❌`	`data=[nested]`	`data=<img src=x />`	`❌`
rust/kekse (fail-hard)	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc ;Secure;Partitioned`	`❌`	`❌`	`❌`	`__Secure-SID=abc ;Secure`	`❌`	`__Host-SID=abc ;Secure;Path=/`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc ;Secure;Partitioned;SameSite=None`	`__Host-SID=abc ;Secure;Partitioned;Path=/`	`SID=abc ;Secure;Partitioned;Domain=example.com`	`❌`	`❌`	`SID=abc ;Secure;Partitioned`	`Partitioned=false`	`SID=abc; Partitioned ;Secure`	`❌`	`❌`	`SID=abc ;SameSite=Strict`	`SID=abc ;SameSite=Lax`	`SID=abc ;SameSite=None`	`SID=abc ;Secure;SameSite=None`	`SID=abc ;SameSite=Lax`	`❌`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc ;Expires=Mon, 01 Jan 1601 00:00:00 GMT`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc ;Domain=.com`	`SID=abc ;Domain=co.uk`	`SID=abc ;Domain=example.co.uk`	`SID=abc ;Domain=xn--mnchen-3ya.de`	`❌`	`❌`	`SID=abc ;Domain=xn--hj8h.eu`	`SID=abc ;Domain=xn--`	`SID=abc ;Domain=ex_ample.com`	`❌`	`❌`	`SID=abc ;Path=file:///etc/passwd`	`SID=abc ;Path=`	`SID=abc ;Path=.`	`SID=abc ;Path=/aaa...aaa`	`SID=abc ;HttpOnly;Secure;Partitioned;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`	`❌`	`SID=v`	`SID=`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`data=[nested]`	`data=<img src=x />`	`❌`
rust/cookie	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;Secure`	`SID=abc ;Path=/b`	`SID=abc ;Secure`	`SID=abc`	`SID=abc`	`SID=abc ;Secure`	`__Secure-SID=abc ;Secure`	`__Secure-SID=abc`	`__Host-SID=abc ;Secure;Path=/`	`__Host-SID=abc ;Path=/`	`__Host-SID=abc ;Secure;Path=/;Domain=example.com`	`__Host-SID=abc ;Secure;Path=/app`	`__host-SID=abc`	`__host-SID=abc ;Secure;Path=/`	`SID=abc ;Secure;SameSite=None`	`__Host-SID=abc ;Secure;Path=/`	`SID=abc ;Secure;Domain=example.com`	`SID=abc ;Secure`	`SID=abc ;Secure`	`SID=abc ;Secure`	`Partitioned=false`	`SID=abc; Partitioned ;Secure`	`SID="abc ;Secure ☢️`	`❌`	`SID=abc ;SameSite=Strict`	`SID=abc ;SameSite=Lax`	`SID=abc ;SameSite=None`	`SID=abc ;Secure;SameSite=None`	`SID=abc ;SameSite=Lax`	`SID=abc`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;Expires=Mon, 06 Nov 1600 08:49:37 GMT`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;Expires=Wed, 01 Jan 1969 00:00:00 GMT`	`SID=abc ;Expires=Thu, 01 Jan 1970 00:00:00 GMT`	`SID=abc ;Expires=Mon, 01 Jan 1601 00:00:00 GMT`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;Domain=com`	`SID=abc ;Domain=co.uk`	`SID=abc ;Domain=example.co.uk`	`SID=abc ;Domain=xn--mnchen-3ya.de`	`SID=abc ;Domain=münchen.de`	`SID=abc ;Domain=🍪.eu`	`SID=abc ;Domain=xn--hj8h.eu`	`SID=abc ;Domain=xn--`	`SID=abc ;Domain=ex_ample.com`	`SID=abc ;Domain=b.example.com`	`SID=abc ;Domain=café ☢️`	`SID=abc ;Path=file:///etc/passwd`	`SID=abc ;Path=`	`SID=abc ;Path=.`	`SID=abc ;Path=/aaa...aaa`	`SID=abc ;HttpOnly;Secure;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`	`SID=a\r\nb ☢️`	`SID=v`	`SID=`	`SID=a\0b ☢️`	`SID=a\x01b ☢️`	`SID=a"b ☢️`	`SID=café ☢️`	`❌`	`❌`	`naïve=v ☢️`	`S ID=abc ☢️`	`SID=a\x7fb ☢️`	`SID=abc`	`SID=abc ;Path=/a\0b`	`token[]=nested ☢️`	`data={"testdata":"JSON"} ☢️`	`data=[nested]`	`data="<img src=x />" ☢️`	`"sid=surrounded-b…<26 chars> ;Secure ☢️`
rust/cookie_store	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;Secure`	`SID=abc ;Path=/b`	`SID=abc ;Secure`	`SID=abc`	`SID=abc`	`SID=abc ;Secure`	`__Secure-SID=abc ;Secure`	`__Secure-SID=abc`	`__Host-SID=abc ;Secure;Path=/`	`__Host-SID=abc ;Path=/`	`__Host-SID=abc ;Secure;Path=/;Domain=example.com`	`__Host-SID=abc ;Secure;Path=/app`	`__host-SID=abc`	`__host-SID=abc ;Secure;Path=/`	`SID=abc ;Secure;SameSite=None`	`__Host-SID=abc ;Secure;Path=/`	`SID=abc ;Secure;Domain=example.com`	`SID=abc ;Secure`	`SID=abc ;Secure`	`SID=abc ;Secure`	`Partitioned=false`	`SID=abc%3B%20Partitioned ;Secure ☢️`	`SID="abc ;Secure ☢️`	`❌`	`SID=abc ;SameSite=Strict`	`SID=abc ;SameSite=Lax`	`SID=abc ;SameSite=None`	`SID=abc ;Secure;SameSite=None`	`SID=abc ;SameSite=Lax`	`SID=abc`	`❌`	`❌`	`❌`	`SID=abc`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`❌`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;Domain=com`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc ;Path=file:///etc/passwd`	`SID=abc ;Path=`	`SID=abc ;Path=.`	`SID=abc ;Path=/aaa...aaa`	`SID=abc ;HttpOnly;Secure;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`	`SID=a\r\nb ☢️`	`SID=v`	`SID=`	`SID=a\0b ☢️`	`SID=a\x01b ☢️`	`SID=a"b ☢️`	`SID=café ☢️`	`❌`	`❌`	`naïve=v ☢️`	`S ID=abc ☢️`	`SID=a\x7fb ☢️`	`SID=abc`	`SID=abc ;Path=/a\0b`	`token[]=nested ☢️`	`data={"testdata":"JSON"} ☢️`	`data=[nested]`	`data="<img src=x />" ☢️`	`"sid=surrounded-b…<26 chars> ;Secure ☢️`
python/SimpleCookie	`SID=abc`	`❌`	`SID=abc`	`SID=abc ;SameSite=Bogus ☢️`	`SID=abc ;Secure`	`SID=abc ;Path=/b`	`❌`	`❌`	`SID=abc`	`❌`	`__Secure-SID=abc ;Secure`	`__Secure-SID=abc`	`__Host-SID=abc ;Secure;Path=/`	`__Host-SID=abc ;Path=/`	`__Host-SID=abc ;Secure;Path=/;Domain=example.com`	`__Host-SID=abc ;Secure;Path=/app`	`__host-SID=abc`	`__host-SID=abc ;Secure;Path=/`	`❌`	`❌`	`❌`	`SID=abc ;Secure`	`SID=abc ;Secure`	`❌`	`Partitioned=false`	`SID=abc%3B%20Partitioned ;Secure ☢️`	`SID=abc; Partitioned ;Secure ☢️`	`❌`	`SID=abc ;SameSite=Strict`	`SID=abc ;SameSite=Lax`	`SID=abc ;SameSite=None`	`SID=abc ;Secure;SameSite=None`	`SID=abc ;SameSite=lAx`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`❌`	`SID=abc`	`SID=abc`	`❌`	`❌`	`SID=abc`	`❌`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`❌`	`❌`	`❌`	`SID=abc`	`❌`	`SID=abc ⚠️`	`❌`	`SID=abc ;Domain=.com`	`SID=abc ;Domain=co.uk`	`SID=abc ;Domain=example.co.uk`	`SID=abc ;Domain=xn--mnchen-3ya.de`	`SID=abc`	`SID=abc`	`SID=abc ;Domain=xn--hj8h.eu`	`SID=abc ;Domain=xn--`	`SID=abc ;Domain=ex_ample.com`	`SID=abc ;Domain=b.example.com`	`SID=abc ;Domain=valid.example.com`	`SID=abc ;Path=file:///etc/passwd`	`SID=abc`	`SID=abc ;Path=.`	`SID=abc ;Path=/aaa...aaa`	`❌`	`❌`	`SID=v`	`SID=`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc`	`SID=abc`	`❌`	`❌`	`data=[nested]`	`data=<img src=x />`	`❌`
python/http.cookiejar	`SID=abc`	`SID=abc`	`❌`	`SID=abc ;SameSite=Bogus ☢️`	`SID=abc ;Secure`	`SID=abc ;Path=/a ☢️`	`SID=abc ;Secure;Partitioned`	`SID=abc ;Partitioned`	`SID=abc ;Partitioned`	`SID=abc ;Secure;Partitioned`	`__Secure-SID=abc ;Secure`	`__Secure-SID=abc`	`__Host-SID=abc ;Secure;Path=/`	`__Host-SID=abc ;Path=/`	`__Host-SID=abc ;Secure;Path=/;Domain=.example.com`	`__Host-SID=abc ;Secure;Path=/app`	`__host-SID=abc`	`__host-SID=abc ;Secure;Path=/`	`SID=abc ;Secure;Partitioned;SameSite=None`	`__Host-SID=abc ;Secure;Partitioned;Path=/`	`SID=abc ;Secure;Partitioned;Domain=.example.com`	`SID=abc ;Secure;Partitioned`	`SID=abc ;Secure;Partitioned`	`SID=abc ;Secure`	`Partitioned=false`	`SID=abc%3B%20Partitioned ;Secure ☢️`	`SID="abc ;Secure ☢️`	`Partitioned= ☢️`	`SID=abc ;SameSite=Strict`	`SID=abc ;SameSite=Lax`	`SID=abc ;SameSite=None`	`SID=abc ;Secure;SameSite=None`	`SID=abc ;SameSite=lAx`	`SID=abc`	`❌`	`❌`	`SID=abc`	`❌`	`❌`	`SID=abc`	`❌`	`SID=abc`	`❌`	`❌`	`SID=abc`	`SID=abc`	`❌`	`SID=abc`	`SID=abc`	`❌`	`SID=abc`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`❌`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`SID=abc`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc ;Path=file:///etc/passwd`	`SID=abc`	`SID=abc ;Path=.`	`SID=abc ;Path=/aaa...aaa`	`SID=abc ;HttpOnly;Secure;Partitioned;SameSite=Lax;Path=/p;Domain=.example.com`	`SID=a\r\nb ☢️`	`SID=v`	`SID=`	`SID=a\0b ☢️`	`SID=a\x01b ☢️`	`SID=a"b ☢️`	`SID=cafÃ© ☢️`	`justvalue= ☢️`	`❌`	`naÃ¯ve=v ☢️`	`S ID=abc ☢️`	`SID=a\x7fb ☢️`	`SID=abc`	`SID=abc ;Path=/a%00b`	`token[]=nested ☢️`	`data={"testdata":"JSON"} ☢️`	`data=[nested]`	`data="<img src=x />" ☢️`	`"sid=surrounded-b…<26 chars> ;Secure ☢️`
python/mitmproxy	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;SameSite=Bogus ☢️`	`SID=abc ;Secure`	`SID=abc ;Path=/b`	`SID=abc ;Secure;Partitioned`	`SID=abc ;Partitioned`	`SID=abc ;Partitioned`	`SID=abc ;Secure;Partitioned`	`__Secure-SID=abc ;Secure`	`__Secure-SID=abc`	`__Host-SID=abc ;Secure;Path=/`	`__Host-SID=abc ;Path=/`	`__Host-SID=abc ;Secure;Path=/;Domain=example.com`	`__Host-SID=abc ;Secure;Path=/app`	`__host-SID=abc`	`__host-SID=abc ;Secure;Path=/`	`SID=abc ;Secure;Partitioned;SameSite=None`	`__Host-SID=abc ;Secure;Partitioned;Path=/`	`SID=abc ;Secure;Partitioned;Domain=example.com`	`SID=abc ;Secure;Partitioned`	`SID=abc ;Secure;Partitioned`	`SID=abc ;Secure;Partitioned`	`Partitioned=false`	`SID=abc%3B%20Partitioned ;Secure ☢️`	`SID=abc; Partitioned ;Secure ☢️`	`Partitioned= ☢️`	`SID=abc ;SameSite=Strict`	`SID=abc ;SameSite=Lax`	`SID=abc ;SameSite=None`	`SID=abc ;Secure;SameSite=None`	`SID=abc ;SameSite=lAx`	`SID=abc ;SameSite= ☢️`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;Domain=.com`	`SID=abc ;Domain=co.uk`	`SID=abc ;Domain=example.co.uk`	`SID=abc ;Domain=xn--mnchen-3ya.de`	`SID=abc ;Domain=mÃ¼nchen.de`	`SID=abc ;Domain=ð\x9f\x8dª.eu`	`SID=abc ;Domain=xn--hj8h.eu`	`SID=abc ;Domain=xn--`	`SID=abc ;Domain=ex_ample.com`	`SID=abc ;Domain=b.example.com`	`SID=abc ;Domain=cafÃ© ☢️`	`SID=abc ;Path=file:///etc/passwd`	`SID=abc ;Path=`	`SID=abc ;Path=.`	`SID=abc ;Path=/aaa...aaa`	`SID=abc ;HttpOnly;Secure;Partitioned;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`	`SID=a\r\nb ☢️`	`SID = v ☢️`	`SID=`	`SID=a\0b ☢️`	`SID=a\x01b ☢️`	`SID=a"b ☢️`	`SID=cafÃ© ☢️`	`justvalue= ☢️`	`=v ☢️`	`naÃ¯ve=v ☢️`	`S ID=abc ☢️`	`SID=a\x7fb ☢️`	`SID=abc`	`SID=abc ;Path=/a\0b`	`token[]=nested ☢️`	`data={"testdata":"JSON"} ☢️`	`data=[nested]`	`data=<img src=x />`	`"sid=surrounded-b…<27 chars> ;Secure ☢️`
node/tough-cookie	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;Secure`	`SID=abc ;Path=/b`	`SID=abc ;Secure;Partitioned`	`SID=abc ;Partitioned`	`SID=abc ;Partitioned`	`SID=abc ;Secure;Partitioned`	`__Secure-SID=abc ;Secure`	`__Secure-SID=abc`	`__Host-SID=abc ;Secure;Path=/`	`__Host-SID=abc ;Path=/`	`__Host-SID=abc ;Secure;Path=/;Domain=example.com`	`__Host-SID=abc ;Secure;Path=/app`	`__host-SID=abc`	`__host-SID=abc ;Secure;Path=/`	`SID=abc ;Secure;Partitioned;SameSite=none`	`__Host-SID=abc ;Secure;Partitioned;Path=/`	`SID=abc ;Secure;Partitioned;Domain=example.com`	`SID=abc ;Secure;Partitioned`	`SID=abc ;Secure;Partitioned`	`SID=abc ;Secure;Partitioned`	`Partitioned=false`	`SID=abc%3B%20Partitioned ;Secure ☢️`	`SID="abc ;Secure ☢️`	`❌`	`SID=abc ;SameSite=strict`	`SID=abc ;SameSite=lax`	`SID=abc ;SameSite=none`	`SID=abc ;Secure;SameSite=none`	`SID=abc ;SameSite=lax`	`SID=abc`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc`	`SID=abc ;Expires=Thu, 03 Mar 1994 00:00:00 GMT`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;Expires=Tue, 01 Jan 2069 00:00:00 GMT`	`SID=abc ;Expires=Thu, 01 Jan 1970 00:00:00 GMT`	`SID=abc ;Expires=Mon, 01 Jan 1601 00:00:00 GMT`	`SID=abc`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Wed, 08 Nov 2006 07:00:00 GMT`	`SID=abc ;Domain=com`	`SID=abc ;Domain=co.uk`	`SID=abc ;Domain=example.co.uk`	`SID=abc ;Domain=xn--mnchen-3ya.de`	`SID=abc ;Domain=mã¼nchen.de`	`SID=abc ;Domain=ð\x9f\x8dª.eu`	`SID=abc ;Domain=xn--hj8h.eu`	`SID=abc ;Domain=xn--`	`SID=abc ;Domain=ex_ample.com`	`SID=abc ;Domain=b.example.com`	`SID=abc ;Domain=cafã© ☢️`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;Path=/aaa...aaa`	`SID=abc ;HttpOnly;Secure;Partitioned;SameSite=lax;Path=/p;Domain=example.com;Max-Age=60`	`SID=a ☢️`	`SID=v`	`SID=`	`SID=a ☢️`	`❌`	`SID=a"b ☢️`	`SID=cafÃ© ☢️`	`❌`	`❌`	`naÃ¯ve=v ☢️`	`S ID=abc ☢️`	`SID=a\x7fb ☢️`	`SID=abc`	`SID=abc ;Path=/a\0b`	`token[]=nested ☢️`	`data={"testdata":"JSON"} ☢️`	`data=[nested]`	`data="<img src=x />" ☢️`	`"sid=surrounded-b…<26 chars> ;Secure ☢️`
node/set-cookie-parser	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;SameSite=Bogus ☢️`	`SID=abc ;Secure`	`SID=abc ;Path=/b`	`SID=abc ;Secure;Partitioned`	`SID=abc ;Partitioned`	`SID=abc ;Partitioned`	`SID=abc ;Secure;Partitioned`	`__Secure-SID=abc ;Secure`	`__Secure-SID=abc`	`__Host-SID=abc ;Secure;Path=/`	`__Host-SID=abc ;Path=/`	`__Host-SID=abc ;Secure;Path=/;Domain=example.com`	`__Host-SID=abc ;Secure;Path=/app`	`__host-SID=abc`	`__host-SID=abc ;Secure;Path=/`	`SID=abc ;Secure;Partitioned;SameSite=None`	`__Host-SID=abc ;Secure;Partitioned;Path=/`	`SID=abc ;Secure;Partitioned;Domain=example.com`	`SID=abc ;Secure;Partitioned`	`SID=abc ;Secure;Partitioned`	`SID=abc ;Secure;Partitioned`	`Partitioned=false`	`SID=abc; Partitioned ;Secure`	`SID="abc ;Secure ☢️`	`❌`	`SID=abc ;SameSite=Strict`	`SID=abc ;SameSite=Lax`	`SID=abc ;SameSite=None`	`SID=abc ;Secure;SameSite=None`	`SID=abc ;SameSite=lAx`	`SID=abc`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc`	`SID=abc ;Expires=Thu, 03 Mar 1994 00:00:00 GMT`	`SID=abc ;Expires=Mon, 06 Nov 1600 08:49:37 GMT`	`SID=abc`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:00 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sat, 11 Jun 1994 08:49:37 GMT`	`SID=abc`	`SID=abc ;Expires=Wed, 01 Jan 1969 00:00:00 GMT`	`SID=abc ;Expires=Thu, 01 Jan 1970 00:00:00 GMT`	`SID=abc ;Expires=Mon, 01 Jan 1601 00:00:00 GMT`	`SID=abc ;Expires=Mon, 07 Nov 1994 00:00:00 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc`	`SID=abc ;Expires=567105180577`	`SID=abc ;Expires=Tue, 06 Nov 2001 08:49:37 GMT`	`SID=abc`	`SID=abc ;Expires=Sun, 06 Nov 1994 07:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc`	`SID=abc ;Domain=.com`	`SID=abc ;Domain=co.uk`	`SID=abc ;Domain=example.co.uk`	`SID=abc ;Domain=xn--mnchen-3ya.de`	`SID=abc ;Domain=mÃ¼nchen.de`	`SID=abc ;Domain=ð\x9f\x8dª.eu`	`SID=abc ;Domain=xn--hj8h.eu`	`SID=abc ;Domain=xn--`	`SID=abc ;Domain=ex_ample.com`	`SID=abc ;Domain=b.example.com`	`SID=abc ;Domain=cafÃ© ☢️`	`SID=abc ;Path=file:///etc/passwd`	`SID=abc`	`SID=abc ;Path=.`	`SID=abc ;Path=/aaa...aaa`	`SID=abc ;HttpOnly;Secure;Partitioned;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`	`SID=a\r\nb ☢️`	`SID = v ☢️`	`SID=`	`SID=a\0b ☢️`	`SID=a\x01b ☢️`	`SID=a"b ☢️`	`SID=cafÃ© ☢️`	`❌`	`❌`	`naÃ¯ve=v ☢️`	`S ID=abc ☢️`	`SID=a\x7fb ☢️`	`SID=abc`	`SID=abc ;Path=/a\0b`	`token[]=nested ☢️`	`data={"testdata":"JSON"} ☢️`	`data=[nested]`	`data="<img src=x />" ☢️`	`"sid=surrounded-b…<27 chars> ;Secure ☢️`
go/net/http	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;Secure`	`SID=abc ;Path=/b`	`SID=abc ;Secure;Partitioned`	`SID=abc ;Partitioned`	`SID=abc ;Partitioned`	`SID=abc ;Secure;Partitioned`	`__Secure-SID=abc ;Secure`	`__Secure-SID=abc`	`__Host-SID=abc ;Secure;Path=/`	`__Host-SID=abc ;Path=/`	`__Host-SID=abc ;Secure;Path=/;Domain=example.com`	`__Host-SID=abc ;Secure;Path=/app`	`__host-SID=abc`	`__host-SID=abc ;Secure;Path=/`	`SID=abc ;Secure;Partitioned;SameSite=None`	`__Host-SID=abc ;Secure;Partitioned;Path=/`	`SID=abc ;Secure;Partitioned;Domain=example.com`	`SID=abc ;Secure;Partitioned`	`SID=abc ;Secure;Partitioned`	`SID=abc ;Secure;Partitioned`	`Partitioned=false`	`SID=abc%3B%20Partitioned ;Secure ☢️`	`❌`	`❌`	`SID=abc ;SameSite=Strict`	`SID=abc ;SameSite=Lax`	`SID=abc ;SameSite=None`	`SID=abc ;Secure;SameSite=None`	`SID=abc ;SameSite=Lax`	`SID=abc`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;Expires=Mon, 06 Nov 1600 08:49:37 GMT`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;Expires=Mon, 01 Jan 1601 00:00:00 GMT`	`SID=abc`	`SID=abc`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;Domain=.com`	`SID=abc ;Domain=co.uk`	`SID=abc ;Domain=example.co.uk`	`SID=abc ;Domain=xn--mnchen-3ya.de`	`SID=abc`	`SID=abc`	`SID=abc ;Domain=xn--hj8h.eu`	`SID=abc ;Domain=xn--`	`SID=abc ;Domain=ex_ample.com`	`SID=abc ;Domain=b.example.com`	`SID=abc ;Domain=valid.example.com`	`SID=abc ;Path=file:///etc/passwd`	`SID=abc`	`SID=abc ;Path=.`	`SID=abc ;Path=/aaa...aaa`	`SID=abc ;HttpOnly;Secure;Partitioned;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`	`❌`	`SID= v ☢️`	`SID=`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc`	`SID=abc`	`❌`	`❌`	`data=[nested]`	`data=<img src=x />`	`❌`
dotnet/Microsoft.Net.Http.Headers	`SID=abc`	`SID=abc`	`❌`	`SID=abc`	`❌`	`SID=abc ;Path=/b`	`SID=abc ;Secure`	`SID=abc`	`SID=abc`	`SID=abc ;Secure`	`__Secure-SID=abc ;Secure`	`__Secure-SID=abc`	`__Host-SID=abc ;Secure;Path=/`	`__Host-SID=abc ;Path=/`	`__Host-SID=abc ;Secure;Path=/;Domain=example.com`	`__Host-SID=abc ;Secure;Path=/app`	`__host-SID=abc`	`__host-SID=abc ;Secure;Path=/`	`SID=abc ;Secure;SameSite=None`	`__Host-SID=abc ;Secure;Path=/`	`SID=abc ;Secure;Domain=example.com`	`SID=abc ;Secure`	`SID=abc ;Secure`	`SID=abc ;Secure`	`Partitioned=false`	`SID=abc%3B%20Partitioned ;Secure ☢️`	`SID= ;Secure ☢️`	`❌`	`SID=abc ;SameSite=Strict`	`SID=abc ;SameSite=Lax`	`SID=abc ;SameSite=None`	`SID=abc ;Secure;SameSite=None`	`SID=abc ;SameSite=Lax`	`SID=abc`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`❌`	`❌`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`❌`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc ;Expires=Thu, 01 Jan 1970 00:00:00 GMT`	`SID=abc ;Expires=Mon, 01 Jan 1601 00:00:00 GMT`	`❌`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`	`❌`	`SID=abc ;Domain=.com`	`SID=abc ;Domain=co.uk`	`SID=abc ;Domain=example.co.uk`	`SID=abc ;Domain=xn--mnchen-3ya.de`	`SID=abc ;Domain=mÃ¼nchen.de`	`SID=abc ;Domain=ð\x9f\x8dª.eu`	`SID=abc ;Domain=xn--hj8h.eu`	`SID=abc ;Domain=xn--`	`SID=abc ;Domain=ex_ample.com`	`SID=abc ;Domain=b.example.com`	`SID=abc ;Domain=cafÃ© ☢️`	`SID=abc ;Path=file:///etc/passwd`	`SID=abc ;Path=`	`SID=abc ;Path=.`	`SID=abc ;Path=/aaa...aaa`	`SID=abc ;HttpOnly;Secure;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`	`❌`	`❌`	`SID=`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc`	`SID=abc ;Path=/a\0b`	`❌`	`❌`	`data=[nested]`	`❌`	`❌`
nginx/proxy (Set-Cookie)	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≠ SID=a%0D%0Ab`	`≠ SID = v`	`≡`	`≠ SID=a%00b`	`≠ SID=a%01b`	`≡`	`≡`	`≡`	`≡`	`≡`	`≡`	`≠ SID=a%7Fb`	`≠ SID=abc; Pa%00th=/`	`≠ SID=abc; Path=/a%00b`	`≡`	`≡`	`≡`	`≡`	`≡`
java/Jakarta RESTEasy	`SID=abc`	`SID=abc`	`❌`	`❌`	`SID=abc ;Secure`	`SID=abc ;Path=/b`	`SID=abc ;Secure`	`SID=abc`	`SID=abc`	`SID=abc ;Secure`	`__Secure-SID=abc ;Secure`	`__Secure-SID=abc`	`__Host-SID=abc ;Secure;Path=/`	`__Host-SID=abc ;Path=/`	`__Host-SID=abc ;Secure;Path=/;Domain=example.com`	`__Host-SID=abc ;Secure;Path=/app`	`__host-SID=abc`	`__host-SID=abc ;Secure;Path=/`	`SID=abc ;Secure;SameSite=None`	`__Host-SID=abc ;Secure;Path=/`	`SID=abc ;Secure;Domain=example.com`	`SID=abc ;Secure`	`SID=abc ;Secure`	`SID=abc ;Secure`	`Partitioned=false`	`SID=abc%3B%20Partitioned ;Secure ☢️`	`SID=abc; Partitioned ;Secure ☢️`	`Partitioned= ☢️`	`SID=abc ;SameSite=Strict`	`SID=abc ;SameSite=Lax`	`SID=abc ;SameSite=None`	`SID=abc ;Secure;SameSite=None`	`SID=abc ;SameSite=Lax`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;Domain=.com`	`SID=abc ;Domain=co.uk`	`SID=abc ;Domain=example.co.uk`	`SID=abc ;Domain=xn--mnchen-3ya.de`	`SID=abc ;Domain=mÃ¼nchen.de`	`SID=abc ;Domain=ð\x9f\x8dª.eu`	`SID=abc ;Domain=xn--hj8h.eu`	`SID=abc ;Domain=xn--`	`SID=abc ;Domain=ex_ample.com`	`SID=abc ;Domain=b.example.com`	`SID=abc ;Domain=cafÃ© ☢️`	`SID=abc ;Path=file:///etc/passwd`	`SID=abc`	`SID=abc ;Path=.`	`SID=abc ;Path=/aaa...aaa`	`SID=abc ;HttpOnly;Secure;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`	`SID=a\r\nb ☢️`	`SID=v`	`SID=`	`SID=a\0b ☢️`	`SID=a\x01b ☢️`	`SID=a"b ☢️`	`SID=cafÃ© ☢️`	`justvalue= ☢️`	`❌`	`naÃ¯ve=v ☢️`	`S ID=abc ☢️`	`SID=a\x7fb ☢️`	`SID=abc`	`SID=abc ;Path=/a\0b`	`token[]=nested ☢️`	`data={"testdata":"JSON"} ☢️`	`data=[nested]`	`data=<img src=x />`	`"sid=surrounded-b…<35 chars> ☢️`
java/Jakarta Jersey	`SID=abc`	`SID=abc`	`❌`	`❌`	`SID=abc ;Secure`	`SID=abc ;Path=/b`	`SID=abc ;Secure`	`SID=abc`	`SID=abc`	`SID=abc ;Secure`	`__Secure-SID=abc ;Secure`	`__Secure-SID=abc`	`__Host-SID=abc ;Secure;Path=/`	`__Host-SID=abc ;Path=/`	`__Host-SID=abc ;Secure;Path=/;Domain=example.com`	`__Host-SID=abc ;Secure;Path=/app`	`__host-SID=abc`	`__host-SID=abc ;Secure;Path=/`	`SID=abc ;Secure;SameSite=None`	`__Host-SID=abc ;Secure;Path=/`	`SID=abc ;Secure;Domain=example.com`	`SID=abc ;Secure`	`SID=abc ;Secure`	`SID=abc ;Secure`	`Partitioned=false`	`SID=abc%3B%20Partitioned ;Secure ☢️`	`SID="abc ;Secure ☢️`	`Partitioned= ☢️`	`SID=abc ;SameSite=Strict`	`SID=abc ;SameSite=Lax`	`SID=abc ;SameSite=None`	`SID=abc ;Secure;SameSite=None`	`SID=abc ;SameSite=Lax`	`❌`	`SID=abc`	`SID=abc`	`❌`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`SID=abc`	`SID=abc`	`❌`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`❌`	`❌`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`❌`	`❌`	`SID=abc`	`❌`	`SID=abc`	`SID=abc`	`❌`	`SID=abc ;Domain=.com`	`SID=abc ;Domain=co.uk`	`SID=abc ;Domain=example.co.uk`	`SID=abc ;Domain=xn--mnchen-3ya.de`	`SID=abc ;Domain=mÃ¼nchen.de`	`SID=abc ;Domain=ð\x9f\x8dª.eu`	`SID=abc ;Domain=xn--hj8h.eu`	`SID=abc ;Domain=xn--`	`SID=abc ;Domain=ex_ample.com`	`SID=abc ;Domain=b.example.com`	`SID=abc ;Domain=cafÃ© ☢️`	`SID=abc ;Path=file:///etc/passwd`	`SID=abc ;Path=`	`SID=abc ;Path=.`	`SID=abc ;Path=/aaa...aaa`	`SID=abc ;HttpOnly;Secure;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`	`SID=a\r\nb ☢️`	`SID=v`	`SID=`	`SID=a\0b ☢️`	`SID=a\x01b ☢️`	`SID=a"b ☢️`	`SID=cafÃ© ☢️`	`justvalue= ☢️`	`=v ☢️`	`naÃ¯ve=v ☢️`	`S ID=abc ☢️`	`SID=a\x7fb ☢️`	`SID=abc`	`SID=abc ;Path=/a\0b`	`token[]=nested ☢️`	`data={"testdata":"JSON"} ☢️`	`data=[nested]`	`data=<img src=x />`	`"sid=surrounded-b…<26 chars> ;Secure ☢️`
java/java.net.HttpCookie	`SID=abc`	`SID=abc`	`❌`	`SID=abc`	`SID=abc ;Secure`	`SID=abc ;Path=/a ☢️`	`SID=abc ;Secure`	`SID=abc`	`SID=abc`	`SID=abc ;Secure`	`__Secure-SID=abc ;Secure`	`__Secure-SID=abc`	`__Host-SID=abc ;Secure;Path=/`	`__Host-SID=abc ;Path=/`	`__Host-SID=abc ;Secure;Path=/;Domain=example.com`	`__Host-SID=abc ;Secure;Path=/app`	`__host-SID=abc`	`__host-SID=abc ;Secure;Path=/`	`SID=abc ;Secure`	`__Host-SID=abc ;Secure;Path=/`	`SID=abc ;Secure;Domain=example.com`	`SID=abc ;Secure`	`SID=abc ;Secure`	`SID=abc ;Secure`	`Partitioned=false`	`SID=abc%3B%20Partitioned ;Secure ☢️`	`SID="abc ;Secure ☢️`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;Secure`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;Domain=.com`	`SID=abc ;Domain=co.uk`	`SID=abc ;Domain=example.co.uk`	`SID=abc ;Domain=xn--mnchen-3ya.de`	`SID=abc ;Domain=mã¼nchen.de`	`SID=abc ;Domain=ð\x9f\x8dª.eu`	`SID=abc ;Domain=xn--hj8h.eu`	`SID=abc ;Domain=xn--`	`SID=abc ;Domain=ex_ample.com`	`SID=abc ;Domain=a.example.com ☢️`	`SID=abc ;Domain=valid.example.com`	`SID=abc ;Path=file:///etc/passwd`	`SID=abc ;Path=`	`SID=abc ;Path=.`	`SID=abc ;Path=/aaa...aaa`	`SID=abc ;HttpOnly;Secure;Path=/p;Domain=example.com;Max-Age=60`	`SID=a\r\nb ☢️`	`SID=v`	`SID=`	`SID=a\0b ☢️`	`SID=a\x01b ☢️`	`SID=a"b ☢️`	`SID=cafÃ© ☢️`	`❌`	`❌`	`❌`	`❌`	`SID=a\x7fb ☢️`	`SID=abc`	`SID=abc ;Path=/a\0b`	`token[]=nested ☢️`	`data={"testdata":"JSON"} ☢️`	`data=[nested]`	`data=<img src=x />`	`"sid=surrounded-b…<26 chars> ;Secure ☢️`
java/Apache HttpClient5	`SID=abc ;Domain=example.com`	`SID=abc ;Domain=example.com`	`SID=abc ;Domain=example.com`	`SID=abc ;SameSite=Bogus;Domain=example.com ☢️`	`SID=abc ;Secure;Domain=example.com`	`SID=abc ;Path=/b;Domain=example.com`	`SID=abc ;Secure;Domain=example.com`	`SID=abc ;Domain=example.com`	`SID=abc ;Domain=example.com`	`SID=abc ;Secure;Domain=example.com`	`__Secure-SID=abc ;Secure;Domain=example.com`	`__Secure-SID=abc ;Domain=example.com`	`__Host-SID=abc ;Secure;Path=/;Domain=example.com`	`__Host-SID=abc ;Path=/;Domain=example.com`	`__Host-SID=abc ;Secure;Path=/;Domain=example.com`	`__Host-SID=abc ;Secure;Path=/app;Domain=example.com`	`__host-SID=abc ;Domain=example.com`	`__host-SID=abc ;Secure;Path=/;Domain=example.com`	`SID=abc ;Secure;SameSite=None;Domain=example.com`	`__Host-SID=abc ;Secure;Path=/;Domain=example.com`	`SID=abc ;Secure;Domain=example.com`	`SID=abc ;Secure;Domain=example.com`	`SID=abc ;Secure;Domain=example.com`	`SID=abc ;Secure;Domain=example.com`	`Partitioned=false ;Domain=example.com`	`SID=abc%3B%20Partitioned ;Secure;Domain=example.com ☢️`	`SID=abc; Partitioned ;Secure;Domain=example.com ☢️`	`❌`	`SID=abc ;SameSite=Strict;Domain=example.com`	`SID=abc ;SameSite=Lax;Domain=example.com`	`SID=abc ;SameSite=None;Domain=example.com`	`SID=abc ;Secure;SameSite=None;Domain=example.com`	`SID=abc ;SameSite=lAx;Domain=example.com`	`SID=abc ;SameSite=;Domain=example.com ☢️`	`SID=abc ;Domain=example.com`	`SID=abc ;Domain=example.com`	`SID=abc ;Domain=example.com`	`SID=abc ;Domain=example.com`	`SID=abc ;Domain=example.com`	`SID=abc ;Domain=example.com`	`SID=abc ;Domain=example.com`	`SID=abc ;Domain=example.com`	`SID=abc ;Domain=example.com`	`SID=abc ;Domain=example.com`	`SID=abc ;Domain=example.com`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc ;Domain=example.com`	`SID=abc ;Domain=example.com`	`SID=abc ;Domain=example.com`	`❌`	`SID=abc ;Domain=example.com`	`SID=abc ;Domain=example.com`	`SID=abc ;Domain=example.com`	`SID=abc ;Domain=example.com`	`❌`	`❌`	`SID=abc ;Domain=example.com`	`SID=abc ;Domain=example.com`	`SID=abc ;Domain=example.com`	`SID=abc ;Domain=example.com`	`SID=abc ;Domain=com`	`SID=abc ;Domain=co.uk`	`SID=abc ;Domain=example.co.uk`	`SID=abc ;Domain=xn--mnchen-3ya.de`	`SID=abc ;Domain=mã¼nchen.de`	`SID=abc ;Domain=ð\x9f\x8dª.eu`	`SID=abc ;Domain=xn--hj8h.eu`	`SID=abc ;Domain=xn--`	`SID=abc ;Domain=ex_ample.com`	`SID=abc ;Domain=b.example.com`	`SID=abc ;Domain=cafã© ☢️`	`SID=abc ;Path=file:///etc/passwd;Domain=example.com`	`SID=abc ;Path⇒default;Domain=example.com`	`SID=abc ;Path=.;Domain=example.com`	`SID=abc ;Path=/aaa...aaa;Domain=example.com`	`SID=abc ;Secure;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`	`SID=a b ;Domain=example.com ☢️`	`SID=v ;Domain=example.com`	`SID= ;Domain=example.com`	`SID=a\0b ;Domain=example.com ☢️`	`SID=a\x01b ;Domain=example.com ☢️`	`SID=ab ;Domain=example.com ☢️`	`SID=cafÃ© ;Domain=example.com ☢️`	`❌`	`❌`	`naÃ¯ve=v ;Domain=example.com ☢️`	`S ID=abc ;Domain=example.com ☢️`	`SID=a\x7fb ;Domain=example.com ☢️`	`SID=abc ;Domain=example.com`	`SID=abc ;Path=/a\0b;Domain=example.com`	`token[]=nested ;Domain=example.com ☢️`	`data={testdata:JSON} ;Domain=example.com ☢️`	`data=[nested] ;Domain=example.com`	`data=<img src=x /> ;Domain=example.com`	`"sid=surrounded-b…<34 chars> ;Domain=example.com ☢️`
c/libcurl	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc ;Secure;Domain=.example.com`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc ;Domain=.com`	`SID=abc ;Domain=.co.uk`	`SID=abc ;Domain=.example.co.uk`	`SID=abc ;Domain=.xn--mnchen-3ya.de`	`SID=abc ;Domain=.mÃ¼nchen.de`	`SID=abc ;Domain=.ð\x9f\x8dª.eu`	`SID=abc ;Domain=.xn--hj8h.eu`	`SID=abc ;Domain=.xn--`	`SID=abc ;Domain=.ex_ample.com`	`SID=abc ;Domain=.b.example.com`	`SID=abc ;Domain=.cafÃ© ☢️`	`❌`	`❌`	`❌`	`❌`	`SID=abc ;HttpOnly;Secure;Path=/p;Domain=.example.com`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`
client/curl	`SID=abc`	`SID=abc`	`❌`	`SID=abc`	`SID=abc`	`SID=abc ;Path=/b`	`SID=abc ;Secure`	`SID=abc`	`SID=abc`	`SID=abc ;Secure`	`__Secure-SID=abc ;Secure`	`❌`	`__Host-SID=abc ;Secure;Path=/`	`❌`	`❌`	`❌`	`__host-SID=abc`	`__host-SID=abc ;Secure;Path=/`	`SID=abc ;Secure`	`__Host-SID=abc ;Secure;Path=/`	`❌`	`SID=abc ;Secure`	`SID=abc ;Secure`	`SID=abc ;Secure`	`Partitioned=false`	`SID=abc%3B%20Partitioned ;Secure ☢️`	`SID="abc ;Secure ☢️`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;Secure`	`SID=abc`	`SID=abc`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc`	`❌`	`SID=abc`	`SID=abc`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`❌`	`SID=abc`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc ;Path=file:///etc/passwd`	`SID=abc`	`SID=abc ;Path=.`	`SID=abc ;Path=/aaa...aaa`	`❌`	`SID=a ☢️`	`SID=v`	`SID=`	`❌`	`❌`	`SID=a"b ☢️`	`SID=cafÃ© ☢️`	`❌`	`=v ☢️`	`naÃ¯ve=v ☢️`	`S ID=abc ☢️`	`❌`	`❌`	`❌`	`token[]=nested ☢️`	`data={"testdata":"JSON"} ☢️`	`data=[nested]`	`data="<img src=x />" ☢️`	`"sid=surrounded-b…<26 chars> ;Secure ☢️`
client/wget	`SID=abc`	`SID=abc`	`❌`	`SID=abc`	`SID=abc ;Secure`	`❌`	`SID=abc ;Secure`	`SID=abc`	`SID=abc`	`SID=abc ;Secure`	`__Secure-SID=abc ;Secure`	`__Secure-SID=abc`	`__Host-SID=abc ;Secure;Path=/`	`__Host-SID=abc ;Path=/`	`❌`	`❌`	`__host-SID=abc`	`__host-SID=abc ;Secure;Path=/`	`SID=abc ;Secure`	`__Host-SID=abc ;Secure;Path=/`	`❌`	`SID=abc ;Secure`	`SID=abc ;Secure`	`SID=abc ;Secure`	`Partitioned=false`	`SID=abc%3B%20Partitioned ;Secure ☢️`	`SID="abc; Partitioned" ;Secure ☢️`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;Secure`	`SID=abc`	`SID=abc`	`❌`	`❌`	`❌`	`SID=abc`	`❌`	`SID=abc`	`❌`	`SID=abc`	`❌`	`❌`	`SID=abc`	`SID=abc`	`❌`	`❌`	`SID=abc`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`❌`	`❌`	`SID=abc`	`❌`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`❌`	`❌`	`SID=abc`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=a ☢️`	`SID=v`	`SID=`	`SID=a ☢️`	`SID=a\x01b ☢️`	`SID=a"b ☢️`	`SID=cafÃ© ☢️`	`❌`	`❌`	`naÃ¯ve=v ☢️`	`❌`	`SID=a\x7fb ☢️`	`SID=abc`	`❌`	`token[]=nested ☢️`	`data={"testdata":"JSON"} ☢️`	`data=[nested]`	`data="<img src=x />" ☢️`	`"sid=surrounded-b…<26 chars> ;Secure ☢️`
browser/chromium	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;SameSite=Lax ☢️`	`SID=abc ;Secure`	`SID=abc ;Path=/b`	`SID=abc ;Secure`	`❌`	`❌`	`SID=abc ;Secure`	`__Secure-SID=abc ;Secure`	`❌`	`__Host-SID=abc ;Secure;Path=/`	`❌`	`❌`	`❌`	`❌`	`__host-SID=abc ;Secure;Path=/`	`SID=abc ;Secure;SameSite=None`	`__Host-SID=abc ;Secure;Path=/`	`❌`	`SID=abc ;Secure`	`SID=abc ;Secure`	`SID=abc ;Secure`	`Partitioned=false`	`SID=abc%3B%20Partitioned ;Secure ☢️`	`SID="abc ;Secure ☢️`	`=Partitioned ☢️`	`SID=abc ;SameSite=Strict`	`SID=abc ;SameSite=Lax`	`❌`	`SID=abc ;Secure;SameSite=None`	`SID=abc ;SameSite=Lax`	`SID=abc ;SameSite=Lax ☢️`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc`	`SID=abc`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`❌`	`SID=abc`	`❌`	`❌`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc ;Path⇒default`	`SID=abc ;Path⇒default`	`SID=abc ;Path⇒default`	`SID=abc ;Path⇒default`	`❌`	`SID=a ☢️`	`SID=v`	`SID=`	`❌`	`❌`	`SID=a"b ☢️`	`SID=café ☢️`	`=justvalue ☢️`	`=v ☢️`	`naïve=v ☢️`	`S ID=abc ☢️`	`❌`	`❌`	`❌`	`token[]=nested ☢️`	`data={"testdata":"JSON"} ☢️`	`data=[nested]`	`data="<img src=x />" ☢️`	`"sid=surrounded-b…<26 chars> ;Secure ☢️`
browser/firefox	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;SameSite=None ☢️`	`SID=abc ;Secure`	`SID=abc ;Path=/b`	`SID=abc ;Secure`	`❌`	`❌`	`SID=abc ;Secure`	`__Secure-SID=abc ;Secure`	`❌`	`__Host-SID=abc ;Secure;Path=/`	`❌`	`❌`	`❌`	`❌`	`__host-SID=abc ;Secure;Path=/`	`SID=abc ;Secure;SameSite=None`	`__Host-SID=abc ;Secure;Path=/`	`❌`	`SID=abc ;Secure`	`SID=abc ;Secure`	`SID=abc ;Secure`	`Partitioned=false`	`SID=abc%3B%20Partitioned ;Secure ☢️`	`SID="abc ;Secure ☢️`	`Partitioned= ☢️`	`SID=abc ;SameSite=Strict`	`SID=abc ;SameSite=Lax`	`❌`	`SID=abc ;Secure;SameSite=None`	`SID=abc ;SameSite=Lax`	`SID=abc ;SameSite=None ☢️`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc`	`❌`	`❌`	`❌`	`❌`	`SID=abc`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc ;Path⇒default`	`SID=abc ;Path⇒default`	`SID=abc ;Path⇒default`	`SID=abc ;Path⇒default`	`❌`	`SID=a ☢️`	`SID=v`	`SID=`	`❌`	`❌`	`SID=a"b ☢️`	`SID=café ☢️`	`justvalue= ☢️`	`❌`	`naÃ¯ve=v ☢️`	`S ID=abc ☢️`	`❌`	`❌`	`❌`	`token[]=nested ☢️`	`data={"testdata":"JSON"} ☢️`	`data=[nested]`	`data="<img src=x />" ☢️`	`"sid=surrounded-b…<26 chars> ;Secure ☢️`
browser/edge	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc ;SameSite=Lax ☢️`	`SID=abc ;Secure`	`SID=abc ;Path=/b`	`SID=abc ;Secure`	`❌`	`❌`	`SID=abc ;Secure`	`__Secure-SID=abc ;Secure`	`❌`	`__Host-SID=abc ;Secure;Path=/`	`❌`	`❌`	`❌`	`❌`	`__host-SID=abc ;Secure;Path=/`	`SID=abc ;Secure;SameSite=None`	`__Host-SID=abc ;Secure;Path=/`	`❌`	`SID=abc ;Secure`	`SID=abc ;Secure`	`SID=abc ;Secure`	`Partitioned=false`	`SID=abc%3B%20Partitioned ;Secure ☢️`	`SID="abc ;Secure ☢️`	`=Partitioned ☢️`	`SID=abc ;SameSite=Strict`	`SID=abc ;SameSite=Lax`	`❌`	`SID=abc ;Secure;SameSite=None`	`SID=abc ;SameSite=Lax`	`SID=abc ;SameSite=Lax ☢️`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc`	`SID=abc`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`❌`	`SID=abc`	`❌`	`❌`	`❌`	`SID=abc`	`SID=abc`	`SID=abc`	`SID=abc`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`❌`	`SID=abc ;Path⇒default`	`SID=abc ;Path⇒default`	`SID=abc ;Path⇒default`	`SID=abc ;Path⇒default`	`❌`	`SID=a ☢️`	`SID=v`	`SID=`	`❌`	`❌`	`SID=a"b ☢️`	`SID=café ☢️`	`=justvalue ☢️`	`=v ☢️`	`naïve=v ☢️`	`S ID=abc ☢️`	`❌`	`❌`	`❌`	`token[]=nested ☢️`	`data={"testdata":"JSON"} ☢️`	`data=[nested]`	`data="<img src=x />" ☢️`	`"sid=surrounded-b…<26 chars> ;Secure ☢️`

Jar probes — domain & path matching (§5.1.3 / §5.1.4)

Domain- and path-matching are two-input relations, so they cannot ride a single wire: each probe stores one Set-Cookie as if received from origin, then asks which cookies the jar would attach to a request to request. [SID=abc] = the cookie is sent; ∅ = it is not — whether the jar refused storage or the match failed (one observable, so the consensus vote works unchanged). rust/rfc_6265 (reference) executes the RFC 6265 §5.3/§5.4 algorithm built directly from that crate's primitives (domain_matches, path_matches, default_path). In the default build it is the bare RFC algorithm — which attaches even a Domain=com supercookie, because rejecting a public suffix is the optional §5.3 step 5; the hardened build applies that policy, like the PSL-aware jars. Codec-only parsers have no jar and drop out of this table. Expiry, eviction, HttpOnly, and SameSite are out of scope here — they are API or time axes, not matching.

jar	jar-host-only-exact	jar-host-only-subdomain	jar-domain-exact	jar-domain-parent	jar-domain-superset	jar-domain-label-boundary	jar-domain-case	jar-domain-leading-dot	jar-domain-ip	jar-domain-supercookie	jar-path-prefix-boundary	jar-path-non-boundary	jar-path-trailing-slash	jar-path-default-sibling	jar-path-default-outside	jar-path-not-absolute	jar-secure-on-http
Set-Cookie	`SID=abc`	`SID=abc`	`SID=abc; Domain=example.com`	`SID=abc; Domain=example.com`	`SID=abc; Domain=sub.example.com`	`SID=abc; Domain=example.com`	`SID=abc; Domain=EXAMPLE.COM`	`SID=abc; Domain=.example.com`	`SID=abc; Domain=127.0.0.1`	`SID=abc; Domain=com`	`SID=abc; Path=/a`	`SID=abc; Path=/a`	`SID=abc; Path=/a/`	`SID=abc`	`SID=abc`	`SID=abc; Path=name`	`SID=abc; Secure`
origin	`https://example.com/`	`https://example.com/`	`https://example.com/`	`https://sub.example.com/`	`https://example.com/`	`https://badexample.com/`	`https://example.com/`	`https://sub.example.com/`	`http://127.0.0.1/`	`https://example.com/`	`https://example.com/`	`https://example.com/`	`https://example.com/`	`https://example.com/dir/page`	`https://example.com/dir/page`	`https://example.com/dir/page`	`https://example.com/`
request	`https://example.com/`	`https://sub.example.com/`	`https://example.com/`	`https://other.example.com/`	`https://sub.example.com/`	`https://example.com/`	`https://example.com/`	`https://example.com/`	`http://127.0.0.1/`	`https://not-example.com/`	`https://example.com/a/b`	`https://example.com/ab`	`https://example.com/a`	`https://example.com/dir/other`	`https://example.com/elsewhere`	`https://example.com/dir/other`	`http://example.com/`
RFC (standard)	host-only: the same host attaches (§5.4)	host-only never flows to subdomains (§5.4)	a Domain cookie flows to matching hosts (§5.1.3)	a Domain cookie flows to matching hosts (§5.1.3)	the origin must domain-match Domain (§5.3 step 6)	a suffix counts only at a label boundary (§5.1.3)	Domain is canonicalized lower-case (§5.1.2)	a leading dot is stripped (§5.2.3)	an IP host matches only by identity (§5.1.3)	rejecting a public-suffix Domain is optional (§5.3 step 5)	a path prefix matches at a `/` boundary (§5.1.4)	a prefix without a boundary never matches (§5.1.4)	`/a/` does not match its parent `/a` (§5.1.4)	no Path → the origin's default-path (§5.3 step 7)	no Path → the origin's default-path (§5.3 step 7)	a non-`/` Path is ignored → default-path (§5.2.4)	Secure needs a secure channel (§5.4)
consensus	`[SID=abc]`	`∅`	`[SID=abc]`	`[SID=abc]`	`∅`	`∅`	`[SID=abc]`	`[SID=abc]`	`[SID=abc]`	`∅`	`[SID=abc]`	`∅`	`∅`	`[SID=abc]`	`∅`	`[SID=abc]`	`∅`
rust/cookie_store	`[SID=abc]`	`∅`	`[SID=abc]`	`[SID=abc]`	`∅`	`∅`	`[SID=abc]`	`[SID=abc]`	`[SID=abc]`	`[SID=abc]`	`[SID=abc]`	`∅`	`∅`	`[SID=abc]`	`∅`	`[SID=abc]`	`∅`
rust/rfc_6265 (reference)	`[SID=abc]`	`∅`	`[SID=abc]`	`[SID=abc]`	`∅`	`∅`	`[SID=abc]`	`[SID=abc]`	`[SID=abc]`	`[SID=abc]`	`[SID=abc]`	`∅`	`∅`	`[SID=abc]`	`∅`	`[SID=abc]`	`∅`
rust/kekse (store)	`[SID=abc]`	`∅`	`[SID=abc]`	`[SID=abc]`	`∅`	`∅`	`[SID=abc]`	`[SID=abc]`	`[SID=abc]`	`[SID=abc]`	`[SID=abc]`	`∅`	`∅`	`[SID=abc]`	`∅`	`[SID=abc]`	`∅`
python/http.cookiejar	`[SID=abc]`	`[SID=abc]`	`[SID=abc]`	`[SID=abc]`	`∅`	`∅`	`[SID=abc]`	`[SID=abc]`	`[SID=abc]`	`∅`	`[SID=abc]`	`∅`	`∅`	`[SID=abc]`	`∅`	`∅`	`∅`
node/tough-cookie	`[SID=abc]`	`∅`	`[SID=abc]`	`[SID=abc]`	`∅`	`∅`	`[SID=abc]`	`[SID=abc]`	`∅`	`∅`	`[SID=abc]`	`∅`	`∅`	`[SID=abc]`	`∅`	`[SID=abc]`	`∅`
browser/chromium	`[SID=abc]`	`∅`	`[SID=abc]`	`[SID=abc]`	`∅`	`∅`	`[SID=abc]`	`[SID=abc]`	`[SID=abc]`	`∅`	`[SID=abc]`	`∅`	`∅`	`[SID=abc]`	`∅`	`[SID=abc]`	`[SID=abc]`
browser/firefox	`[SID=abc]`	`∅`	`[SID=abc]`	`[SID=abc]`	`∅`	`∅`	`[SID=abc]`	`[SID=abc]`	`[SID=abc]`	`∅`	`[SID=abc]`	`∅`	`∅`	`[SID=abc]`	`∅`	`[SID=abc]`	`∅`
browser/edge	`[SID=abc]`	`∅`	`[SID=abc]`	`[SID=abc]`	`∅`	`∅`	`[SID=abc]`	`[SID=abc]`	`[SID=abc]`	`∅`	`[SID=abc]`	`∅`	`∅`	`[SID=abc]`	`∅`	`[SID=abc]`	`∅`

Attribute fidelity

resp-all-attrs sets all seven non-date attributes; this is which each parser surfaces. ◌ marks an attribute the driver's reporting channel cannot observe (classic WebDriver and the Netscape jar format carry no Partitioned field) — not a drop. ✗ = dropped — except the client jars' Max-Age, which they fold into an absolute expiry rather than report as such. The eighth attribute, Expires, is shown per parser in the date-* columns of the Set-Cookie table above rather than here. Parsers that rejected the cookie outright are omitted.

parser	HttpOnly	Secure	SameSite	Path	Domain	Max-Age	Partitioned
rust/kekse (lenient)	✓	✓	✓	✓	✓	✓	✓
rust/kekse (strict)	✓	✓	✓	✓	✓	✓	✓
rust/kekse (fail-hard)	✓	✓	✓	✓	✓	✓	✓
rust/cookie	✓	✓	✓	✓	✓	✓	✗
rust/cookie_store	✓	✓	✓	✓	✓	✓	✗
python/http.cookiejar	✓	✓	✓	✓	✓	✗	✓
python/mitmproxy	✓	✓	✓	✓	✓	✓	✓
node/tough-cookie	✓	✓	✓	✓	✓	✓	✓
node/set-cookie-parser	✓	✓	✓	✓	✓	✓	✓
go/net/http	✓	✓	✓	✓	✓	✓	✓
dotnet/Microsoft.Net.Http.Headers	✓	✓	✓	✓	✓	✓	◌
java/Jakarta RESTEasy	✓	✓	✓	✓	✓	✓	◌
java/Jakarta Jersey	✓	✓	✓	✓	✓	✓	◌
java/java.net.HttpCookie	✓	✓	✗	✓	✓	✓	◌
java/Apache HttpClient5	✗	✓	✓	✓	✓	✓	◌
c/libcurl	✓	✓	✗	✓	✓	✗	◌

Calibration

kekse's two dials graded against the answering parse columns, per response row: a wire strict parses clean must be majority-accepted (law A — strict-clean means universally sendable), and a majority-accepted wire must be lenient-accepted (law B — lenient is calibrated to reality) unless it is a listed deliberate deviation with its reason. Store-backed columns (client jars, browsers, cookie_store) report storage policy, not parse verdicts, so they do not vote; subjects never vote. A violation of either law fails the matrix run.

Both laws hold over this run's answering columns (12 deliberate lenient deviation(s) listed below).

scenario	verdict	accepting	rejecting	reason
resp-quoted-attr-text	deliberate deviation	11 (rust/cookie, python/SimpleCookie, python/http.cookiejar, python/mitmproxy, node/tough-cookie, node/set-cookie-parser, dotnet/Microsoft.Net.Http.Headers, java/Jakarta RESTEasy, java/Jakarta Jersey, java/java.net.HttpCookie, java/Apache HttpClient5)	2 (go/net/http, c/libcurl)	§5.2 splits before any unquoting, leaving a bare `"abc` value the octet rule refuses; quote-spanning parsers swallow the attribute into the value instead (with the raw `;` re-emission hazard that carries)
resp-crlf	deliberate deviation	9 (rust/cookie, python/http.cookiejar, python/mitmproxy, node/tough-cookie, node/set-cookie-parser, java/Jakarta RESTEasy, java/Jakarta Jersey, java/java.net.HttpCookie, java/Apache HttpClient5)	4 (python/SimpleCookie, go/net/http, dotnet/Microsoft.Net.Http.Headers, c/libcurl)	a raw CR/LF, NUL, or other control byte in a value is the header-injection / log-poison vector kekse refuses in every mode — the permissive majority keeps it, and re-emission then splits or poisons the carrying header
resp-ctl-nul	deliberate deviation	9 (rust/cookie, python/http.cookiejar, python/mitmproxy, node/tough-cookie, node/set-cookie-parser, java/Jakarta RESTEasy, java/Jakarta Jersey, java/java.net.HttpCookie, java/Apache HttpClient5)	4 (python/SimpleCookie, go/net/http, dotnet/Microsoft.Net.Http.Headers, c/libcurl)	a raw CR/LF, NUL, or other control byte in a value is the header-injection / log-poison vector kekse refuses in every mode — the permissive majority keeps it, and re-emission then splits or poisons the carrying header
resp-ctl-other	deliberate deviation	8 (rust/cookie, python/http.cookiejar, python/mitmproxy, node/set-cookie-parser, java/Jakarta RESTEasy, java/Jakarta Jersey, java/java.net.HttpCookie, java/Apache HttpClient5)	5 (python/SimpleCookie, node/tough-cookie, go/net/http, dotnet/Microsoft.Net.Http.Headers, c/libcurl)	a raw CR/LF, NUL, or other control byte in a value is the header-injection / log-poison vector kekse refuses in every mode — the permissive majority keeps it, and re-emission then splits or poisons the carrying header
resp-quote-interior	deliberate deviation	9 (rust/cookie, python/http.cookiejar, python/mitmproxy, node/tough-cookie, node/set-cookie-parser, java/Jakarta RESTEasy, java/Jakarta Jersey, java/java.net.HttpCookie, java/Apache HttpClient5)	4 (python/SimpleCookie, go/net/http, dotnet/Microsoft.Net.Http.Headers, c/libcurl)	a bare DQUOTE is outside the cookie-octet alphabet in both gradings; quote-tolerant parsers keep it and diverge on where the value ends
resp-non-ascii	deliberate deviation	9 (rust/cookie, python/http.cookiejar, python/mitmproxy, node/tough-cookie, node/set-cookie-parser, java/Jakarta RESTEasy, java/Jakarta Jersey, java/java.net.HttpCookie, java/Apache HttpClient5)	4 (python/SimpleCookie, go/net/http, dotnet/Microsoft.Net.Http.Headers, c/libcurl)	a raw non-ASCII byte is outside the cookie-octet alphabet; percent-encoding is the lossless carrier kekse insists on
resp-non-ascii-name	deliberate deviation	8 (rust/cookie, python/http.cookiejar, python/mitmproxy, node/tough-cookie, node/set-cookie-parser, java/Jakarta RESTEasy, java/Jakarta Jersey, java/Apache HttpClient5)	5 (python/SimpleCookie, go/net/http, dotnet/Microsoft.Net.Http.Headers, java/java.net.HttpCookie, c/libcurl)	kekse requires an RFC 7230 token as the cookie-name (deliberately stricter than §5.2's anything-before-`=`): a non-token name has no wire form kekse's own writer could emit, so the pair is refused as unusable
resp-space-in-name	deliberate deviation	8 (rust/cookie, python/http.cookiejar, python/mitmproxy, node/tough-cookie, node/set-cookie-parser, java/Jakarta RESTEasy, java/Jakarta Jersey, java/Apache HttpClient5)	5 (python/SimpleCookie, go/net/http, dotnet/Microsoft.Net.Http.Headers, java/java.net.HttpCookie, c/libcurl)	kekse requires an RFC 7230 token as the cookie-name (deliberately stricter than §5.2's anything-before-`=`): a non-token name has no wire form kekse's own writer could emit, so the pair is refused as unusable
resp-del-byte	deliberate deviation	9 (rust/cookie, python/http.cookiejar, python/mitmproxy, node/tough-cookie, node/set-cookie-parser, java/Jakarta RESTEasy, java/Jakarta Jersey, java/java.net.HttpCookie, java/Apache HttpClient5)	4 (python/SimpleCookie, go/net/http, dotnet/Microsoft.Net.Http.Headers, c/libcurl)	a raw CR/LF, NUL, or other control byte in a value is the header-injection / log-poison vector kekse refuses in every mode — the permissive majority keeps it, and re-emission then splits or poisons the carrying header
resp-array-name	deliberate deviation	9 (rust/cookie, python/http.cookiejar, python/mitmproxy, node/tough-cookie, node/set-cookie-parser, java/Jakarta RESTEasy, java/Jakarta Jersey, java/java.net.HttpCookie, java/Apache HttpClient5)	4 (python/SimpleCookie, go/net/http, dotnet/Microsoft.Net.Http.Headers, c/libcurl)	kekse requires an RFC 7230 token as the cookie-name (deliberately stricter than §5.2's anything-before-`=`): a non-token name has no wire form kekse's own writer could emit, so the pair is refused as unusable
resp-json-value	deliberate deviation	9 (rust/cookie, python/http.cookiejar, python/mitmproxy, node/tough-cookie, node/set-cookie-parser, java/Jakarta RESTEasy, java/Jakarta Jersey, java/java.net.HttpCookie, java/Apache HttpClient5)	4 (python/SimpleCookie, go/net/http, dotnet/Microsoft.Net.Http.Headers, c/libcurl)	a bare DQUOTE is outside the cookie-octet alphabet in both gradings; quote-tolerant parsers keep it and diverge on where the value ends
resp-quoted-pair-flag	deliberate deviation	9 (rust/cookie, python/http.cookiejar, python/mitmproxy, node/tough-cookie, node/set-cookie-parser, java/Jakarta RESTEasy, java/Jakarta Jersey, java/java.net.HttpCookie, java/Apache HttpClient5)	4 (python/SimpleCookie, go/net/http, dotnet/Microsoft.Net.Http.Headers, c/libcurl)	kekse requires an RFC 7230 token as the cookie-name (deliberately stricter than §5.2's anything-before-`=`): a non-token name has no wire form kekse's own writer could emit, so the pair is refused as unusable

Tested scenarios

One line per test — the id each matrix column is headed by, and what its wire probes. Outcomes are not repeated here; read them from the tables above (a bold cell diverges from the consensus).

keksbruch — parser divergence matrix

Legend

Request `Cookie:` parsers

Response `Set-Cookie:` parsers

Jar probes — domain & path matching (§5.1.3 / §5.1.4)

Attribute fidelity

Calibration

Tested scenarios

Request `Cookie:` scenarios

Response `Set-Cookie:` scenarios

Jar probe scenarios

Remarks

Tested against

keksbruch — parser divergence matrix

Legend

Request Cookie: parsers

Response Set-Cookie: parsers

Jar probes — domain & path matching (§5.1.3 / §5.1.4)

Attribute fidelity

Calibration

Tested scenarios

Request Cookie: scenarios

Response Set-Cookie: scenarios

Jar probe scenarios

Remarks

Tested against

Request `Cookie:` parsers

Response `Set-Cookie:` parsers

Request `Cookie:` scenarios

Response `Set-Cookie:` scenarios