# keksbruch — parser divergence matrix

How cookie parsers across languages handle the same difficult and malformed wire — surfacing where implementations diverge.
Generated by `cargo test -p keksbruch --features differential -- --ignored`.



## Legend

| symbol | meaning |
| --- | --- |
| `[n=v, …]` | a request `Cookie:` header parsed into these name=value pairs, in order |
| `∅` | parsed successfully, but into zero cookies |
| `name=value ;Attr;…` | a `Set-Cookie` parsed into one cookie, with its attributes after the `;` |
| `❌` | the parser rejected the whole header or cookie (fail-hard) |
| `n/a` | the parser does not handle this direction (e.g. a request-only library asked to parse a `Set-Cookie`) |
| `SKIP` | the parser or its toolchain was unavailable in this run |
| `☠️` | the parser **crashed** on this payload — an in-process panic, or a sidecar killed by a signal, a non-zero exit, or a hang |
| `⚠️` | the parser accepted the cookie/header but reported recovered issues — hover the cell for the list; issues never affect the outcome or the consensus vote |
| `≡` | a proxy (nginx) forwarded the cookie byte-for-byte |
| `≠ …` | a proxy forwarded the cookie but altered the bytes (the altered value follows) |
| `⟨array⟩ / ⟨object⟩` | the value was parsed as a non-string type — PHP's `$_COOKIE` arrays/maps — shown by type name |
| `☢️` | on a `Set-Cookie`, the tool's parse **contradicts kekse's typed reading**: it stored a cookie kekse rejects, read an attribute value differently, or asserted one kekse never parsed (hover in the HTML report for the field-by-field comparison) |
| `Path⇒default` | a jar dropped the wire's unusable or absent `Path` and scoped the cookie to its request default-path (§5.1.4); the harness value (browsers `/r`, curl/wget/libcurl/HttpClient5 `/`) is plumbing, so the fall-back is stated, not printed |

A **bold** cell differs from the real-world *consensus* — the modal outcome of the other parsers.
A `☢️` cell is the mirror axis: it contradicts *kekse*, the subject we assert is correct, rather than the crowd — the two marks are independent, and a cell may carry both.
kekse — and, on the jar probes, the rfc_6265 reference — is a subject under test, excluded from the consensus vote.
Rows are tools, columns are tests; the `payload` row is the exact wire (non-displayable bytes shown `\0` `\r` `\n` `\xNN`).
The matrix is split into three tables: the **request** `Cookie:` parsers, the **response** `Set-Cookie:` parsers, and the **jar probes** (client stores exercised end-to-end), each listing only the tools that engage that axis (so none is a wall of `n/a`).

## Request `Cookie:` parsers

| tool | `ws-surrounding` | `ws-internal` | `ctl-nul` | `ctl-crlf` | `ctl-other` | `quote-unbalanced` | `quote-interior` | `pct-truncated` | `pct-bad-utf8` | `raw-non-utf8` | `delim-semicolon` | `delim-empty-segments` | `no-equals` | `extra-equals` | `dup-name` | `dup-case` | `empty-name` | `empty-value` | `raw-non-ascii` | `non-ascii-name` | `scale-huge-value` | `scale-many-pairs` | `scale-control-junk` | `req-partitioned-name` | `nul-in-name` | `nul-between-cookies` | `tab-around` | `raw-emoji` | `pct-emoji` | `array-name` | `assoc-name` | `json-value` | `bracket-value` | `markup-no-equals` | `markup-name` | `quoted-html-value` | `truthy` | `equals-bare` | `equals-double` | `nul-empty-name` |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| **payload** | `  n  =  v  ` | `n=a b` | `n=a\0b; m=ok` | `n=a\r\nb; m=ok` | `n=a\x01b; m=ok` | `n="v; m=ok` | `n=a"b; m=ok` | `n=%4; m=ok` | `n=%FF; m=ok` | `n=a\xffb` | `n=a;evil=1` | `n=v;;;m=w` | `flag; n=v` | `n=a=b` | `k=1; k=2; k=3` | `sid=lo; SID=hi` | `=v; m=ok` | `n=; m=ok` | `n=café; m=ok` | `naïve=v; m=ok` | `n=xxxxxxxxxxxxxxxxxxxxxxxxxx…<4098>` | `k0=v0; k1=v1; k2=v2; k3=v3; …<172>` | `a=1; j=\x01\x01\x01\x01\x01\…<16396>` | `Partitioned=false; m=ok` | `n\0x=v; m=ok` | `a=1; \0b=2; c=3` | `\tn\t=\tv\t; m=ok` | `n=🤖; m=ok` | `n=%F0%9F%A4%96; m=ok` | `token[]=nested; m=ok` | `sess[k]=v; m=ok` | `data={"testdata":"JSON"}; m=ok` | `data=[nested]; m=ok` | `<script>; m=ok` | `<script>=empty; m=ok` | `data="<img src=x />"; m=ok` | `truthy=yes; m=ok` | `=` | `==` | `\0=; m=ok` |
| **RFC (standard)** | — | — | — | — | — | — | — | — | — | — | `;` splits → 2 pairs | — | skip bad pair, keep rest | split on first `=` | all duplicates kept | — | skip bad pair, keep rest | empty value is valid | — | — | — | — | — | — | — | — | — | — | — | non-token name skipped | non-token name skipped | DQUOTE is not a cookie-octet | `[` `]` are cookie-octets | skip bad pair, keep rest | non-token name skipped | — | — | skip bad pair, keep rest | skip bad pair, keep rest | non-token name skipped |
| **consensus** | `[n=v]` | `[n=a b]` | `[n=a\0b, m=ok]` | `[n=a\r\nb, m=ok]` | `[n=a\x01b, m=ok]` | `[n="v, m=ok]` | `[n=a"b, m=ok]` | `[n=%4, m=ok]` | `[n=%FF, m=ok]` | `[n=aÿb]` | `[n=a, evil=1]` | `[n=v, m=w]` | `[flag=, n=v]` | `[n=a=b]` | `[k=1, k=2, k=3]` | `[sid=lo, SID=hi]` | `[m=ok]` | `[n=, m=ok]` | `[n=café, m=ok]` | `[naïve=v, m=ok]` | `[n=xxx...xxx…<4096 chars>]` | `[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]` | `[a=1, j=\x01\x01\x01...\x01\x01\x01…<4096 chars>, b=2]` | `[Partitioned=false, m=ok]` | `[n\0x=v, m=ok]` | `[a=1, \0b=2, c=3]` | `[n=v, m=ok]` | `[n=ð\x9f¤\x96, m=ok]` | `[n=%F0%9F%A4%96, m=ok]` | `[token[]=nested, m=ok]` | `[sess[k]=v, m=ok]` | `[data={"testdata":"JSON"}, m=ok]` | `[data=[nested], m=ok]` | `[m=ok]` | `[<script>=empty, m=ok]` | `[data=<img src=x />, m=ok]` | `[truthy=yes, m=ok]` | `∅` | `∅` | `[\0=, m=ok]` |
| rust/kekse (lenient) | `[n=v]` | `[n=a b]` | **`[m=ok] ⚠️`** | **`[m=ok] ⚠️`** | **`[m=ok] ⚠️`** | **`[m=ok] ⚠️`** | **`[m=ok] ⚠️`** | `[n=%4, m=ok]` | **`[m=ok] ⚠️`** | `n/a` | `[n=a, evil=1]` | `[n=v, m=w]` | **`[n=v] ⚠️`** | `[n=a=b]` | `[k=1, k=2, k=3]` | `[sid=lo, SID=hi]` | `[m=ok] ⚠️` | `[n=, m=ok]` | **`[m=ok] ⚠️`** | **`[m=ok] ⚠️`** | `[n=xxx...xxx…<4096 chars>]` | `[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]` | **`[a=1, b=2] ⚠️`** | `[Partitioned=false, m=ok]` | **`[m=ok] ⚠️`** | **`[a=1, c=3] ⚠️`** | `[n=v, m=ok]` | **`[m=ok] ⚠️`** | **`[n=🤖, m=ok]`** | **`[m=ok] ⚠️`** | **`[m=ok] ⚠️`** | **`[m=ok] ⚠️`** | `[data=[nested], m=ok]` | `[m=ok] ⚠️` | **`[m=ok] ⚠️`** | `[data=<img src=x />, m=ok]` | `[truthy=yes, m=ok]` | `∅ ⚠️` | `∅ ⚠️` | **`[m=ok] ⚠️`** |
| rust/kekse (strict) | `[n=v]` | **`∅ ⚠️`** | **`[m=ok] ⚠️`** | **`[m=ok] ⚠️`** | **`[m=ok] ⚠️`** | **`[m=ok] ⚠️`** | **`[m=ok] ⚠️`** | `[n=%4, m=ok]` | **`[m=ok] ⚠️`** | `n/a` | `[n=a, evil=1]` | `[n=v, m=w]` | **`[n=v] ⚠️`** | `[n=a=b]` | `[k=1, k=2, k=3]` | `[sid=lo, SID=hi]` | `[m=ok] ⚠️` | `[n=, m=ok]` | **`[m=ok] ⚠️`** | **`[m=ok] ⚠️`** | `[n=xxx...xxx…<4096 chars>]` | `[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]` | **`[a=1, b=2] ⚠️`** | `[Partitioned=false, m=ok]` | **`[m=ok] ⚠️`** | **`[a=1, c=3] ⚠️`** | `[n=v, m=ok]` | **`[m=ok] ⚠️`** | **`[n=🤖, m=ok]`** | **`[m=ok] ⚠️`** | **`[m=ok] ⚠️`** | **`[m=ok] ⚠️`** | `[data=[nested], m=ok]` | `[m=ok] ⚠️` | **`[m=ok] ⚠️`** | **`[m=ok] ⚠️`** | `[truthy=yes, m=ok]` | `∅ ⚠️` | `∅ ⚠️` | **`[m=ok] ⚠️`** |
| rust/kekse (fail-hard) | `[n=v]` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `[n=%4, m=ok]` | **`❌`** | `n/a` | `[n=a, evil=1]` | `[n=v, m=w]` | **`❌`** | `[n=a=b]` | `[k=1, k=2, k=3]` | `[sid=lo, SID=hi]` | **`❌`** | `[n=, m=ok]` | **`❌`** | **`❌`** | `[n=xxx...xxx…<4096 chars>]` | `[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]` | **`❌`** | `[Partitioned=false, m=ok]` | **`❌`** | **`❌`** | `[n=v, m=ok]` | **`❌`** | **`[n=🤖, m=ok]`** | **`❌`** | **`❌`** | **`❌`** | `[data=[nested], m=ok]` | **`❌`** | **`❌`** | **`❌`** | `[truthy=yes, m=ok]` | **`❌`** | **`❌`** | **`❌`** |
| rust/cookie | `[n=v]` | `[n=a b]` | `[n=a\0b, m=ok]` | `[n=a\r\nb, m=ok]` | `[n=a\x01b, m=ok]` | `[n="v, m=ok]` | `[n=a"b, m=ok]` | `[n=%4, m=ok]` | **`[m=ok] ⚠️`** | `n/a` | `[n=a, evil=1]` | `[n=v, m=w]` | **`[n=v] ⚠️`** | `[n=a=b]` | `[k=1, k=2, k=3]` | `[sid=lo, SID=hi]` | `[m=ok] ⚠️` | `[n=, m=ok]` | **`[n=café, m=ok]`** | **`[naïve=v, m=ok]`** | `[n=xxx...xxx…<4096 chars>]` | `[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]` | `[a=1, j=\x01\x01\x01...\x01\x01\x01…<4096 chars>, b=2]` | `[Partitioned=false, m=ok]` | `[n\0x=v, m=ok]` | `[a=1, \0b=2, c=3]` | `[n=v, m=ok]` | **`[n=🤖, m=ok]`** | **`[n=🤖, m=ok]`** | `[token[]=nested, m=ok]` | `[sess[k]=v, m=ok]` | `[data={"testdata":"JSON"}, m=ok]` | `[data=[nested], m=ok]` | `[m=ok] ⚠️` | `[<script>=empty, m=ok]` | **`[data="<img src=x />", m=ok]`** | `[truthy=yes, m=ok]` | `∅ ⚠️` | `∅ ⚠️` | `[\0=, m=ok]` |
| rust/biscotti | `[n=v]` | `[n=a b]` | `[n=a\0b, m=ok]` | `[n=a\r\nb, m=ok]` | `[n=a\x01b, m=ok]` | `[n="v, m=ok]` | `[n=a"b, m=ok]` | `[n=%4, m=ok]` | **`❌`** | `n/a` | `[n=a, evil=1]` | `[n=v, m=w]` | **`❌`** | `[n=a=b]` | `[k=1, k=2, k=3]` | `[sid=lo, SID=hi]` | **`❌`** | `[n=, m=ok]` | **`[n=café, m=ok]`** | **`[naïve=v, m=ok]`** | `[n=xxx...xxx…<4096 chars>]` | `[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]` | `[a=1, j=\x01\x01\x01...\x01\x01\x01…<4096 chars>, b=2]` | `[Partitioned=false, m=ok]` | `[n\0x=v, m=ok]` | `[a=1, \0b=2, c=3]` | `[n=v, m=ok]` | **`[n=🤖, m=ok]`** | **`[n=🤖, m=ok]`** | `[token[]=nested, m=ok]` | `[sess[k]=v, m=ok]` | `[data={"testdata":"JSON"}, m=ok]` | `[data=[nested], m=ok]` | **`❌`** | `[<script>=empty, m=ok]` | **`[data="<img src=x />", m=ok]`** | `[truthy=yes, m=ok]` | **`❌`** | **`❌`** | `[\0=, m=ok]` |
| rust/axum-extra | `[n=v]` | `[n=a b]` | **`❌`** | **`❌`** | **`❌`** | **`[m=ok, n="v]`** | **`[m=ok, n=a"b]`** | **`[m=ok, n=%4]`** | **`[m=ok]`** | `n/a` | **`[evil=1, n=a]`** | **`[m=w, n=v]`** | **`[n=v]`** | `[n=a=b]` | **`[k=3]`** | **`[SID=hi, sid=lo]`** | `[m=ok]` | **`[m=ok, n=]`** | **`∅`** | **`∅`** | `[n=xxx...xxx…<4096 chars>]` | **`[k0=v0, k1=v1, k10=v10, k11=v11, …(+17 more)]`** | **`❌`** | `[Partitioned=false, m=ok]` | **`❌`** | **`❌`** | **`[m=ok, n=v]`** | **`∅`** | **`[m=ok, n=🤖]`** | **`[m=ok, token[]=nested]`** | **`[m=ok, sess[k]=v]`** | `[data={"testdata":"JSON"}, m=ok]` | `[data=[nested], m=ok]` | `[m=ok]` | `[<script>=empty, m=ok]` | **`[data="<img src=x />", m=ok]`** | **`[m=ok, truthy=yes]`** | `∅` | `∅` | **`❌`** |
| python/SimpleCookie | `[n=v]` | **`∅`** | **`∅`** | **`∅`** | **`∅`** | **`∅`** | **`∅`** | `[n=%4, m=ok]` | `[n=%FF, m=ok]` | **`∅`** | `[n=a, evil=1]` | **`[n=v]`** | **`∅`** | `[n=a=b]` | **`[k=3]`** | `[sid=lo, SID=hi]` | **`∅`** | `[n=, m=ok]` | **`∅`** | **`∅`** | `[n=xxx...xxx…<4096 chars>]` | `[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]` | **`[a=1]`** | `[Partitioned=false, m=ok]` | **`∅`** | **`[a=1]`** | `[n=v, m=ok]` | **`∅`** | `[n=%F0%9F%A4%96, m=ok]` | **`∅`** | **`∅`** | **`∅`** | `[data=[nested], m=ok]` | **`∅`** | **`❌`** | `[data=<img src=x />, m=ok]` | `[truthy=yes, m=ok]` | `∅` | **`❌`** | **`∅`** |
| python/Werkzeug | `[n=v]` | `[n=a b]` | `[n=a\0b, m=ok]` | **`[a\r\nb=, m=ok]`** | `[n=a\x01b, m=ok]` | `[n="v, m=ok]` | `[n=a"b, m=ok]` | `[n=%4, m=ok]` | `[n=%FF, m=ok]` | **`❌`** | `[n=a, evil=1]` | `[n=v, m=w]` | `[flag=, n=v]` | `[n=a=b]` | `[k=1, k=2, k=3]` | `[sid=lo, SID=hi]` | `[m=ok]` | `[n=, m=ok]` | **`[n=café, m=ok]`** | **`[naïve=v, m=ok]`** | `[n=xxx...xxx…<4096 chars>]` | `[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]` | `[a=1, j=\x01\x01\x01...\x01\x01\x01…<4096 chars>, b=2]` | `[Partitioned=false, m=ok]` | `[n\0x=v, m=ok]` | `[a=1, \0b=2, c=3]` | `[n=v, m=ok]` | **`[n=🤖, m=ok]`** | `[n=%F0%9F%A4%96, m=ok]` | `[token[]=nested, m=ok]` | `[sess[k]=v, m=ok]` | `[data={"testdata":"JSON"}, m=ok]` | `[data=[nested], m=ok]` | **`[<script>=, m=ok]`** | `[<script>=empty, m=ok]` | `[data=<img src=x />, m=ok]` | `[truthy=yes, m=ok]` | `∅` | `∅` | `[\0=, m=ok]` |
| python/mitmproxy | **`[n  =  v  ]`** | `[n=a b]` | `[n=a\0b, m=ok]` | `[n=a\r\nb, m=ok]` | `[n=a\x01b, m=ok]` | **`[n=v; m=ok]`** | `[n=a"b, m=ok]` | `[n=%4, m=ok]` | `[n=%FF, m=ok]` | `[n=aÿb]` | `[n=a, evil=1]` | `[n=v, m=w]` | `[flag=, n=v]` | `[n=a=b]` | `[k=1, k=2, k=3]` | `[sid=lo, SID=hi]` | **`[=v, m=ok]`** | `[n=, m=ok]` | `[n=café, m=ok]` | `[naïve=v, m=ok]` | `[n=xxx...xxx…<4096 chars>]` | `[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]` | `[a=1, j=\x01\x01\x01...\x01\x01\x01…<4096 chars>, b=2]` | `[Partitioned=false, m=ok]` | `[n\0x=v, m=ok]` | `[a=1, \0b=2, c=3]` | **`[n\t=\tv\t, m=ok]`** | `[n=ð\x9f¤\x96, m=ok]` | `[n=%F0%9F%A4%96, m=ok]` | `[token[]=nested, m=ok]` | `[sess[k]=v, m=ok]` | `[data={"testdata":"JSON"}, m=ok]` | `[data=[nested], m=ok]` | **`[<script>=, m=ok]`** | `[<script>=empty, m=ok]` | `[data=<img src=x />, m=ok]` | `[truthy=yes, m=ok]` | `∅` | **`[==]`** | `[\0=, m=ok]` |
| node/cookie | `[n=v]` | `[n=a b]` | `[n=a\0b, m=ok]` | `[n=a\r\nb, m=ok]` | `[n=a\x01b, m=ok]` | `[n="v, m=ok]` | `[n=a"b, m=ok]` | `[n=%4, m=ok]` | `[n=%FF, m=ok]` | `[n=aÿb]` | `[n=a, evil=1]` | `[n=v, m=w]` | **`[n=v]`** | `[n=a=b]` | **`[k=1]`** | `[sid=lo, SID=hi]` | **`[=v, m=ok]`** | `[n=, m=ok]` | `[n=café, m=ok]` | `[naïve=v, m=ok]` | `[n=xxx...xxx…<4096 chars>]` | `[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]` | `[a=1, j=\x01\x01\x01...\x01\x01\x01…<4096 chars>, b=2]` | `[Partitioned=false, m=ok]` | `[n\0x=v, m=ok]` | `[a=1, \0b=2, c=3]` | `[n=v, m=ok]` | `[n=ð\x9f¤\x96, m=ok]` | **`[n=🤖, m=ok]`** | `[token[]=nested, m=ok]` | `[sess[k]=v, m=ok]` | `[data={"testdata":"JSON"}, m=ok]` | `[data=[nested], m=ok]` | `[m=ok]` | `[<script>=empty, m=ok]` | `[data=<img src=x />, m=ok]` | `[truthy=yes, m=ok]` | `∅` | **`[==]`** | `[\0=, m=ok]` |
| node/universal-cookie | `[n=v]` | **`[n=v]`** | **`[n=a b]`** | **`[n=a\0b, m=ok]`** | **`[n=a\r\nb, m=ok]`** | **`[n=a\x01b, m=ok]`** | **`[n="v, m=ok]`** | **`[n=a"b, m=ok]`** | **`[n=%4, m=ok]`** | **`[n=%FF, m=ok]`** | **`[n=aÿb]`** | **`[n=a, evil=1]`** | **`[n=v, m=w]`** | **`[n=v]`** | **`[n=a=b]`** | **`[k=1]`** | **`[sid=lo, SID=hi]`** | **`[=v, m=ok]`** | **`[n=, m=ok]`** | **`[n=café, m=ok]`** | **`[naïve=v, m=ok]`** | **`[n=xxx...xxx…<4096 chars>]`** | **`[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]`** | **`[a=1, j=\x01\x01\x01...\x01\x01\x01…<4096 chars>, b=2]`** | **`[Partitioned=false, m=ok]`** | **`[n\0x=v, m=ok]`** | **`[a=1, \0b=2, c=3]`** | **`[n=v, m=ok]`** | **`[n=ð\x9f¤\x96, m=ok]`** | **`[n=🤖, m=ok]`** | **`[token[]=nested, m=ok]`** | **`[sess[k]=v, m=ok]`** | **`[data={"testdata":"JSON"}, m=ok]`** | **`[data=[nested], m=ok]`** | **`[m=ok]`** | **`[<script>=empty, m=ok]`** | **`[data="<img src=x />", m=ok]`** | **`[truthy=yes, m=ok]`** | `∅` | **`[==]`** |
| node/js-cookie | **`[  n  =  v  ]`** | `[n=a b]` | `[n=a\0b, m=ok]` | `[n=a\r\nb, m=ok]` | `[n=a\x01b, m=ok]` | **`[n=, m=ok]`** | `[n=a"b, m=ok]` | `[n=%4, m=ok]` | **`[m=ok]`** | `[n=aÿb]` | **`[n=a;evil=1]`** | **`[n=v;;;m=w]`** | `[flag=, n=v]` | `[n=a=b]` | **`[k=1]`** | `[sid=lo, SID=hi]` | **`[=v, m=ok]`** | `[n=, m=ok]` | `[n=café, m=ok]` | `[naïve=v, m=ok]` | `[n=xxx...xxx…<4096 chars>]` | `[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]` | `[a=1, j=\x01\x01\x01...\x01\x01\x01…<4096 chars>, b=2]` | `[Partitioned=false, m=ok]` | `[n\0x=v, m=ok]` | `[a=1, \0b=2, c=3]` | **`[\tn\t=\tv\t, m=ok]`** | `[n=ð\x9f¤\x96, m=ok]` | **`[n=🤖, m=ok]`** | `[token[]=nested, m=ok]` | `[sess[k]=v, m=ok]` | `[data={"testdata":"JSON"}, m=ok]` | `[data=[nested], m=ok]` | **`[<script>=, m=ok]`** | `[<script>=empty, m=ok]` | `[data=<img src=x />, m=ok]` | `[truthy=yes, m=ok]` | **`[=]`** | **`[==]`** | `[\0=, m=ok]` |
| go/net/http | **`❌`** | `[n=a b]` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `[n=%4, m=ok]` | `[n=%FF, m=ok]` | **`❌`** | `[n=a, evil=1]` | **`❌`** | **`❌`** | `[n=a=b]` | `[k=1, k=2, k=3]` | `[sid=lo, SID=hi]` | **`❌`** | `[n=, m=ok]` | **`❌`** | **`❌`** | `[n=xxx...xxx…<4096 chars>]` | `[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]` | **`❌`** | `[Partitioned=false, m=ok]` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `[n=%F0%9F%A4%96, m=ok]` | **`❌`** | **`❌`** | **`❌`** | `[data=[nested], m=ok]` | **`❌`** | **`❌`** | `[data=<img src=x />, m=ok]` | `[truthy=yes, m=ok]` | **`❌`** | **`❌`** | **`❌`** |
| dotnet/Microsoft.Net.Http.Headers | **`❌`** | **`❌`** | **`[m=ok]`** | **`[m=ok]`** | **`[m=ok]`** | **`[n=, m=ok]`** | **`[m=ok]`** | `[n=%4, m=ok]` | `[n=%FF, m=ok]` | **`❌`** | `[n=a, evil=1]` | `[n=v, m=w]` | **`[n=v]`** | `[n=a=b]` | `[k=1, k=2, k=3]` | `[sid=lo, SID=hi]` | `[m=ok]` | `[n=, m=ok]` | **`[m=ok]`** | **`[m=ok]`** | `[n=xxx...xxx…<4096 chars>]` | `[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]` | **`[a=1, b=2]`** | `[Partitioned=false, m=ok]` | **`[m=ok]`** | **`[a=1, c=3]`** | **`[m=ok]`** | **`[m=ok]`** | `[n=%F0%9F%A4%96, m=ok]` | **`[m=ok]`** | **`[m=ok]`** | **`[m=ok]`** | `[data=[nested], m=ok]` | `[m=ok]` | **`[m=ok]`** | **`[m=ok]`** | `[truthy=yes, m=ok]` | **`❌`** | **`❌`** | **`[m=ok]`** |
| php/$_COOKIE | **`[n__=  v  ]`** | `[n=a b]` | **`[n=a]`** | **`❌`** | `[n=a\x01b, m=ok]` | `[n="v, m=ok]` | `[n=a"b, m=ok]` | `[n=%4, m=ok]` | **`[n=ÿ, m=ok]`** | `[n=aÿb]` | `[n=a, evil=1]` | `[n=v, m=w]` | `[flag=, n=v]` | `[n=a=b]` | **`[k=1]`** | `[sid=lo, SID=hi]` | `[m=ok]` | `[n=, m=ok]` | `[n=café, m=ok]` | `[naïve=v, m=ok]` | `[n=xxx...xxx…<4096 chars>]` | `[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]` | `[a=1, j=\x01\x01\x01...\x01\x01\x01…<4096 chars>, b=2]` | `[Partitioned=false, m=ok]` | **`[n=]`** | **`[a=1]`** | **`[n\t=\tv\t, m=ok]`** | `[n=ð\x9f¤\x96, m=ok]` | **`[n=ð\x9f¤\x96, m=ok]`** | **`[token=⟨array⟩["nested"], m=ok]`** | **`[sess=⟨object⟩{"k":"v"}, m=ok]`** | `[data={"testdata":"JSON"}, m=ok]` | `[data=[nested], m=ok]` | **`[<script>=, m=ok]`** | `[<script>=empty, m=ok]` | **`[data="<img src=x />", m=ok]`** | `[truthy=yes, m=ok]` | `∅` | `∅` | **`∅`** |
| nginx/$cookie_<name> | `[n=v]` | `[n=a b]` | **`❌`** | **`❌`** | `[n=a\x01b, m=ok]` | `[n="v, m=ok]` | `[n=a"b, m=ok]` | `[n=%4, m=ok]` | `[n=%FF, m=ok]` | `[n=aÿb]` | `[n=a, evil=1]` | `[n=v, m=w]` | **`[n=v]`** | `[n=a=b]` | **`[k=1]`** | **`[sid=lo, SID=lo]`** | `[m=ok]` | `[n=, m=ok]` | `[n=café, m=ok]` | `[naïve=v, m=ok]` | `[n=xxx...xxx…<4096 chars>]` | `[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]` | `[a=1, j=\x01\x01\x01...\x01\x01\x01…<4096 chars>, b=2]` | `[Partitioned=false, m=ok]` | **`❌`** | **`❌`** | **`[m=ok]`** | `[n=ð\x9f¤\x96, m=ok]` | `[n=%F0%9F%A4%96, m=ok]` | `[token[]=nested, m=ok]` | `[sess[k]=v, m=ok]` | `[data={"testdata":"JSON"}, m=ok]` | `[data=[nested], m=ok]` | `[m=ok]` | `[<script>=empty, m=ok]` | **`[data="<img src=x />", m=ok]`** | `[truthy=yes, m=ok]` | `∅` | `∅` | **`❌`** |
| nginx/lua-resty-cookie | **`[n  =]`** | **`[n=a]`** | **`❌`** | **`❌`** | **`[m=ok, n=a\x01b]`** | **`[m=ok, n="v]`** | **`[m=ok, n=a"b]`** | **`[m=ok, n=%4]`** | **`[m=ok, n=%FF]`** | `[n=aÿb]` | **`[evil=1, n=a]`** | **`[;;m=w, n=v]`** | **`[flag; n=v]`** | `[n=a=b]` | **`[k=3]`** | **`[SID=hi, sid=lo]`** | **`[=v, m=ok]`** | **`[m=ok, n=]`** | **`[m=ok, n=café]`** | **`[m=ok, naïve=v]`** | `[n=xxx...xxx…<4096 chars>]` | **`[k0=v0, k1=v1, k10=v10, k11=v11, …(+17 more)]`** | **`[a=1, b=2, j=\x01\x01\x01...\x01\x01\x01…<4096 chars>]`** | `[Partitioned=false, m=ok]` | **`❌`** | **`❌`** | **`[n\t=, v\t; m=ok]`** | **`[m=ok, n=ð\x9f¤\x96]`** | **`[m=ok, n=%F0%9F%A4%96]`** | **`[m=ok, token[]=nested]`** | **`[m=ok, sess[k]=v]`** | `[data={"testdata":"JSON"}, m=ok]` | `[data=[nested], m=ok]` | **`[<script>; m=ok]`** | `[<script>=empty, m=ok]` | **`[/>"; m=ok, data="<img, src=x]`** | **`[m=ok, truthy=yes]`** | **`[=]`** | **`[==]`** | **`❌`** |
| nginx/proxy | `≠ n  =  v` | `≡` | `❌` | `❌` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `❌` | `❌` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `❌` |
| java/Tomcat RFC6265 | `[n=v]` | **`∅`** | **`[m=ok]`** | **`[m=ok]`** | **`[m=ok]`** | **`[n=v, m=ok]`** | **`[m=ok]`** | `[n=%4, m=ok]` | `[n=%FF, m=ok]` | `[n=aÿb]` | `[n=a, evil=1]` | `[n=v, m=w]` | `[flag=, n=v]` | `[n=a=b]` | `[k=1, k=2, k=3]` | `[sid=lo, SID=hi]` | `[m=ok]` | `[n=, m=ok]` | `[n=café, m=ok]` | **`[m=ok]`** | `[n=xxx...xxx…<4096 chars>]` | `[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]` | **`[a=1, b=2]`** | `[Partitioned=false, m=ok]` | **`[m=ok]`** | **`[a=1, c=3]`** | `[n=v, m=ok]` | `[n=ð\x9f¤\x96, m=ok]` | `[n=%F0%9F%A4%96, m=ok]` | **`[m=ok]`** | **`[m=ok]`** | **`[m=ok]`** | `[data=[nested], m=ok]` | `[m=ok]` | **`[m=ok]`** | **`[m=ok]`** | `[truthy=yes, m=ok]` | `∅` | `∅` | **`[m=ok]`** |
| java/Tomcat legacy | `[n=v]` | **`[n=a]`** | **`❌`** | **`❌`** | **`❌`** | **`∅`** | **`[n=a, m=ok]`** | `[n=%4, m=ok]` | `[n=%FF, m=ok]` | **`❌`** | `[n=a, evil=1]` | `[n=v, m=w]` | **`[n=v]`** | **`[n=a]`** | `[k=1, k=2, k=3]` | `[sid=lo, SID=hi]` | `[m=ok]` | **`[m=ok]`** | **`❌`** | **`❌`** | `[n=xxx...xxx…<4096 chars>]` | `[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]` | **`❌`** | `[Partitioned=false, m=ok]` | **`❌`** | **`❌`** | `[n=v, m=ok]` | **`❌`** | `[n=%F0%9F%A4%96, m=ok]` | **`[m=ok]`** | **`[m=ok]`** | **`[m=ok]`** | **`[m=ok]`** | `[m=ok]` | **`[m=ok]`** | `[data=<img src=x />, m=ok]` | `[truthy=yes, m=ok]` | `∅` | `∅` | **`❌`** |
| java/Jakarta RESTEasy | `[n=v]` | `[n=a b]` | `[n=a\0b, m=ok]` | `[n=a\r\nb, m=ok]` | `[n=a\x01b, m=ok]` | `[n="v, m=ok]` | `[n=a"b, m=ok]` | `[n=%4, m=ok]` | `[n=%FF, m=ok]` | `[n=aÿb]` | `[n=a, evil=1]` | `[n=v, m=w]` | `[flag=, n=v]` | `[n=a=b]` | `[k=1, k=2, k=3]` | `[sid=lo, SID=hi]` | **`[=v, m=ok]`** | `[n=, m=ok]` | `[n=café, m=ok]` | `[naïve=v, m=ok]` | `[n=xxx...xxx…<4096 chars>]` | `[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]` | **`[a=1, j=, b=2]`** | `[Partitioned=false, m=ok]` | `[n\0x=v, m=ok]` | **`[a=1, b=2, c=3]`** | `[n=v, m=ok]` | `[n=ð\x9f¤\x96, m=ok]` | `[n=%F0%9F%A4%96, m=ok]` | `[token[]=nested, m=ok]` | `[sess[k]=v, m=ok]` | `[data={"testdata":"JSON"}, m=ok]` | `[data=[nested], m=ok]` | **`[<script>=, m=ok]`** | `[<script>=empty, m=ok]` | `[data=<img src=x />, m=ok]` | `[truthy=yes, m=ok]` | **`[=]`** | **`[==]`** | **`[=, m=ok]`** |
| java/Jakarta Jersey | `[n=v]` | `[n=a b]` | `[n=a\0b, m=ok]` | `[n=a\r\nb, m=ok]` | `[n=a\x01b, m=ok]` | `[n="v, m=ok]` | `[n=a"b, m=ok]` | `[n=%4, m=ok]` | `[n=%FF, m=ok]` | `[n=aÿb]` | `[n=a, evil=1]` | `[n=v, m=w]` | `[flag=, n=v]` | `[n=a=b]` | `[k=1, k=2, k=3]` | `[sid=lo, SID=hi]` | **`[=v, m=ok]`** | `[n=, m=ok]` | `[n=café, m=ok]` | `[naïve=v, m=ok]` | `[n=xxx...xxx…<4096 chars>]` | `[k0=v0, k1=v1, k2=v2, k3=v3, …(+17 more)]` | **`[a=1, j=, b=2]`** | `[Partitioned=false, m=ok]` | `[n\0x=v, m=ok]` | **`[a=1, b=2, c=3]`** | `[n=v, m=ok]` | `[n=ð\x9f¤\x96, m=ok]` | `[n=%F0%9F%A4%96, m=ok]` | `[token[]=nested, m=ok]` | `[sess[k]=v, m=ok]` | `[data={"testdata":"JSON"}, m=ok]` | `[data=[nested], m=ok]` | **`[<script>=, m=ok]`** | `[<script>=empty, m=ok]` | `[data=<img src=x />, m=ok]` | `[truthy=yes, m=ok]` | **`[=]`** | **`[==]`** | **`[=, m=ok]`** |

## Response `Set-Cookie:` parsers

| tool | `attr-unknown` | `attr-unknown-bare` | `attr-bad-maxage` | `attr-garbage-samesite` | `attr-valued-flag` | `attr-duplicate` | `resp-partitioned-secure` | `resp-partitioned-bare` | `resp-partitioned-valued` | `resp-partitioned-dup` | `prefix-secure-ok` | `prefix-secure-missing` | `prefix-host-ok` | `prefix-host-missing-secure` | `prefix-host-domain` | `prefix-host-path` | `prefix-host-case` | `prefix-host-case-conformant` | `resp-partitioned-samesite-none` | `prefix-host-partitioned` | `resp-partitioned-domain` | `resp-partitioned-false` | `resp-partitioned-true` | `resp-partitioned-case` | `resp-partitioned-name` | `resp-encoded-semicolon-attr` | `resp-quoted-attr-text` | `resp-partitioned-leading` | `resp-samesite-strict` | `resp-samesite-lax` | `resp-samesite-none-bare` | `resp-samesite-none-secure` | `resp-samesite-case` | `resp-samesite-empty` | `date-imf-fixdate` | `date-rfc850` | `date-asctime` | `date-no-weekday` | `date-wrong-weekday` | `date-nonsense-weekday` | `date-no-timezone` | `date-reordered` | `date-2digit-year-imf-shape` | `date-trailing-comment` | `date-unix` | `date-garbage` | `date-impossible-day` | `date-year-pre-1601` | `date-minute-out-of-range` | `date-second-out-of-range` | `date-iso8601` | `date-us-slash` | `date-eu-dotted` | `date-epoch` | `date-2digit-year-69` | `date-2digit-year-70` | `date-year-1601-boundary` | `date-hour-out-of-range` | `date-1-digit-day` | `date-month-case` | `date-month-overlong` | `date-year-trailing-alpha` | `date-5-digit-year` | `date-missing-year` | `date-empty` | `date-zone-offset` | `date-tab-delims` | `date-first-token-wins` | `domain-supercookie-tld` | `domain-supercookie-icann` | `domain-registrable` | `domain-punycode` | `domain-utf8` | `domain-emoji-utf8` | `domain-emoji-punycode` | `domain-malformed-punycode` | `domain-not-a-host-name` | `domain-dup-last-wins` | `domain-dup-valid-then-invalid` | `path-file-uri` | `path-empty` | `path-dot` | `path-overlong-1025` | `resp-all-attrs` | `resp-crlf` | `resp-ws-surrounding` | `resp-empty-value` | `resp-ctl-nul` | `resp-ctl-other` | `resp-quote-interior` | `resp-non-ascii` | `resp-nameless-bare` | `resp-nameless-eq` | `resp-non-ascii-name` | `resp-space-in-name` | `resp-del-byte` | `attr-nul-name` | `attr-nul-value` | `resp-array-name` | `resp-json-value` | `resp-bracket-value` | `resp-quoted-html-value` | `resp-quoted-pair-flag` |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| **payload** | `SID=abc; Priority=High` | `SID=abc; Priority` | `SID=abc; Max-Age=banana` | `SID=abc; SameSite=Bogus` | `SID=abc; Secure=1` | `SID=abc; Path=/a; Path=/b` | `SID=abc; Partitioned; Secure` | `SID=abc; Partitioned` | `SID=abc; Partitioned=1` | `SID=abc; Partitioned; Partit…<41>` | `__Secure-SID=abc; Secure` | `__Secure-SID=abc` | `__Host-SID=abc; Secure; Path=/` | `__Host-SID=abc; Path=/` | `__Host-SID=abc; Secure; Path…<50>` | `__Host-SID=abc; Secure; Path=/app` | `__host-SID=abc` | `__host-SID=abc; Secure; Path=/` | `SID=abc; SameSite=None; Secu…<43>` | `__Host-SID=abc; Secure; Path…<43>` | `SID=abc; Secure; Domain=exam…<48>` | `SID=abc; Secure; Partitioned=false` | `SID=abc; Secure; Partitioned=true` | `SID=abc; Secure; pArTiTiOnEd` | `Partitioned=false` | `SID=abc%3B%20Partitioned; Secure` | `SID="abc; Partitioned"; Secure` | `Partitioned; SID=abc` | `SID=abc; SameSite=Strict` | `SID=abc; SameSite=Lax` | `SID=abc; SameSite=None` | `SID=abc; SameSite=None; Secure` | `SID=abc; SameSite=lAx` | `SID=abc; SameSite=` | `SID=abc; Expires=Sun, 06 Nov…<46>` | `SID=abc; Expires=Sunday, 06-…<47>` | `SID=abc; Expires=Sun Nov  6 …<41>` | `SID=abc; Expires=06 Nov 1994…<41>` | `SID=abc; Expires=Mon, 06 Nov…<46>` | `SID=abc; Expires=Birthday, 0…<51>` | `SID=abc; Expires=Sun, 06 Nov…<42>` | `SID=abc; Expires=08:49:37 19…<37>` | `SID=abc; Expires=Sun, 06 Nov…<44>` | `SID=abc; Expires=Sun, 06 Nov…<52>` | `SID=abc; Expires=Sun Nov  6 …<45>` | `SID=abc; Expires=not-a-date` | `SID=abc; Expires=Sun, 31 Feb…<46>` | `SID=abc; Expires=Sun, 06 Nov…<46>` | `SID=abc; Expires=Sun, 06 Nov…<46>` | `SID=abc; Expires=Sun, 06 Nov…<46>` | `SID=abc; Expires=1994-11-06T…<37>` | `SID=abc; Expires=11/06/1994 08:49:37` | `SID=abc; Expires=06.11.1994 08:49:37` | `SID=abc; Expires=784108177` | `SID=abc; Expires=Tue, 01 Jan…<44>` | `SID=abc; Expires=Thu, 01 Jan…<44>` | `SID=abc; Expires=Mon, 01 Jan…<46>` | `SID=abc; Expires=Sun, 06 Nov…<46>` | `SID=abc; Expires=Sun, 6 Nov …<45>` | `SID=abc; Expires=Sun, 06 NOV…<46>` | `SID=abc; Expires=06 Novembre…<42>` | `SID=abc; Expires=06 Nov 1994…<39>` | `SID=abc; Expires=06 Nov 1994…<38>` | `SID=abc; Expires=Sun, 06 Nov…<41>` | `SID=abc; Expires=` | `SID=abc; Expires=Sun, 06 Nov…<51>` | `SID=abc; Expires=Sun,\t06\tN…<51>` | `SID=abc; Expires=07:00:00 08…<46>` | `SID=abc; Domain=.com` | `SID=abc; Domain=co.uk` | `SID=abc; Domain=example.co.uk` | `SID=abc; Domain=xn--mnchen-3ya.de` | `SID=abc; Domain=münchen.de` | `SID=abc; Domain=🍪.eu` | `SID=abc; Domain=xn--hj8h.eu` | `SID=abc; Domain=xn--` | `SID=abc; Domain=ex_ample.com` | `SID=abc; Domain=a.example.co…<51>` | `SID=abc; Domain=valid.exampl…<46>` | `SID=abc; Path=file:///etc/passwd` | `SID=abc; Path=` | `SID=abc; Path=.` | `SID=abc; Path=/aaaaaaaaaaaaa…<1039>` | `SID=abc; Path=/p; Domain=exa…<93>` | `SID=a\r\nb` | `  SID  =  v  ` | `SID=` | `SID=a\0b` | `SID=a\x01b` | `SID=a"b` | `SID=café` | `justvalue` | `=v` | `naïve=v` | `S ID=abc` | `SID=a\x7fb` | `SID=abc; Pa\0th=/` | `SID=abc; Path=/a\0b` | `token[]=nested` | `data={"testdata":"JSON"}` | `data=[nested]` | `data="<img src=x />"` | `"sid=surrounded-by-doublequo…<40>` |
| **RFC (standard)** | keep cookie, ignore attr (§5.2) | — | keep cookie, ignore attr (§5.2) | keep cookie, ignore attr (§5.2) | — | keep cookie, last wins (§5.2) | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | 6265bis: samesite-av parses | 6265bis: samesite-av parses | 6265bis: None requires Secure | 6265bis: None + Secure | 6265bis: value is case-insensitive | keep cookie, ignore attr (§5.2) | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | §5.1.1: 69 → 2069 | §5.1.1: 70 → 1970 | §5.1.1: year ≥ 1601 is valid | §5.1.1: hour > 23 fails | §5.1.1: day is 1*2DIGIT | §5.1.1: month is case-insensitive | §5.1.1: month = first 3 letters | §5.1.1: non-digit year tail ignored | §5.1.1: year is 2*4DIGIT | §5.1.1: all four fields required | no date → ignore Expires (§5.2.1) | §5.1.1: zone tokens ignored | §5.1.1: HTAB is a delimiter | §5.1.1: first match binds each field | — | — | — | — | — | — | — | — | — | — | — | — | — | — | path-av has no length cap (§4.1.1) | — | CR/LF must not be smuggled | trim leading/trailing WSP | empty value is valid | CTL is not a cookie-octet | CTL is not a cookie-octet | DQUOTE is not a cookie-octet | non-ASCII is not a cookie-octet | no `=` → ignore the line (§5.2) | empty name — spec-gray (§5.2) | non-token name skipped | non-token name skipped | CTL is not a cookie-octet | — | — | non-token name skipped | DQUOTE is not a cookie-octet | `[` `]` are cookie-octets | — | non-token name skipped |
| **consensus** | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc ;Secure` | `SID=abc ;Path=/b` | `SID=abc ;Secure` | `SID=abc` | `SID=abc` | `SID=abc ;Secure` | `__Secure-SID=abc ;Secure` | `__Secure-SID=abc` | `__Host-SID=abc ;Secure;Path=/` | `__Host-SID=abc ;Path=/` | `__Host-SID=abc ;Secure;Path=/;Domain=example.com` | `__Host-SID=abc ;Secure;Path=/app` | `__host-SID=abc` | `__host-SID=abc ;Secure;Path=/` | `SID=abc ;Secure;SameSite=None` | `__Host-SID=abc ;Secure;Path=/` | `❌` | `SID=abc ;Secure` | `SID=abc ;Secure` | `SID=abc ;Secure` | `Partitioned=false` | `SID=abc%3B%20Partitioned ;Secure` | `SID="abc ;Secure` | `❌` | `SID=abc ;SameSite=Strict` | `SID=abc ;SameSite=Lax` | `SID=abc ;SameSite=None` | `SID=abc ;Secure;SameSite=None` | `SID=abc ;SameSite=Lax` | `SID=abc` | `❌` | `❌` | `❌` | `❌` | `❌` | `SID=abc` | `❌` | `❌` | `❌` | `❌` | `❌` | `SID=abc` | `SID=abc` | `❌` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `❌` | `SID=abc` | `SID=abc` | `❌` | `❌` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `❌` | `SID=abc` | `SID=abc` | `SID=abc ;Domain=.com` | `SID=abc ;Domain=co.uk` | `SID=abc ;Domain=example.co.uk` | `SID=abc ;Domain=xn--mnchen-3ya.de` | `❌` | `❌` | `SID=abc ;Domain=xn--hj8h.eu` | `SID=abc ;Domain=xn--` | `SID=abc ;Domain=ex_ample.com` | `SID=abc ;Domain=b.example.com` | `❌` | `SID=abc ;Path=file:///etc/passwd` | `SID=abc` | `SID=abc ;Path=.` | `SID=abc ;Path=/aaa...aaa` | `❌` | `SID=a\r\nb` | `SID=v` | `SID=` | `❌` | `❌` | `SID=a"b` | `SID=café` | `❌` | `❌` | `naïve=v` | `S ID=abc` | `SID=a\x7fb` | `SID=abc` | `SID=abc ;Path=/a\0b` | `token[]=nested` | `data={"testdata":"JSON"}` | `data=[nested]` | `data="<img src=x />"` | `"sid=surrounded-b…<26 chars> ;Secure` |
| rust/kekse (lenient) | `SID=abc ⚠️` | `SID=abc ⚠️` | `SID=abc ⚠️` | `SID=abc ⚠️` | `SID=abc ;Secure ⚠️` | `SID=abc ;Path=/b ⚠️` | **`SID=abc ;Secure;Partitioned`** | **`SID=abc ;Partitioned ⚠️`** | **`SID=abc ;Partitioned ⚠️`** | **`SID=abc ;Secure;Partitioned ⚠️`** | `__Secure-SID=abc ;Secure` | `__Secure-SID=abc ⚠️` | `__Host-SID=abc ;Secure;Path=/` | `__Host-SID=abc ;Path=/ ⚠️` | `__Host-SID=abc ;Secure;Path=/;Domain=example.com ⚠️` | `__Host-SID=abc ;Secure;Path=/app ⚠️` | `__host-SID=abc ⚠️` | `__host-SID=abc ;Secure;Path=/ ⚠️` | **`SID=abc ;Secure;Partitioned;SameSite=None`** | **`__Host-SID=abc ;Secure;Partitioned;Path=/`** | **`SID=abc ;Secure;Partitioned;Domain=example.com`** | **`SID=abc ;Secure;Partitioned ⚠️`** | **`SID=abc ;Secure;Partitioned ⚠️`** | **`SID=abc ;Secure;Partitioned`** | `Partitioned=false` | **`SID=abc; Partitioned ;Secure`** | **`❌`** | `❌` | `SID=abc ;SameSite=Strict` | `SID=abc ;SameSite=Lax` | `SID=abc ;SameSite=None` | `SID=abc ;Secure;SameSite=None` | `SID=abc ;SameSite=Lax` | `SID=abc ⚠️` | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | `SID=abc ⚠️` | `SID=abc ⚠️` | **`SID=abc ⚠️`** | `SID=abc ⚠️` | `SID=abc ⚠️` | `SID=abc ⚠️` | `SID=abc ⚠️` | `SID=abc ⚠️` | `SID=abc ⚠️` | **`SID=abc ;Expires=Tue, 01 Jan 2069 00:00:00 GMT`** | **`SID=abc ;Expires=Thu, 01 Jan 1970 00:00:00 GMT`** | **`SID=abc ;Expires=Mon, 01 Jan 1601 00:00:00 GMT`** | `SID=abc ⚠️` | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | `SID=abc ⚠️` | `SID=abc ⚠️` | `SID=abc ⚠️` | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Wed, 08 Nov 2006 07:00:00 GMT`** | `SID=abc ;Domain=.com` | `SID=abc ;Domain=co.uk` | `SID=abc ;Domain=example.co.uk` | `SID=abc ;Domain=xn--mnchen-3ya.de` | **`SID=abc ⚠️`** | **`SID=abc ⚠️`** | `SID=abc ;Domain=xn--hj8h.eu` | `SID=abc ;Domain=xn--` | `SID=abc ;Domain=ex_ample.com` | `SID=abc ;Domain=b.example.com ⚠️` | **`SID=abc ;Domain=valid.example.com ⚠️`** | `SID=abc ;Path=file:///etc/passwd` | **`SID=abc ;Path=`** | `SID=abc ;Path=.` | `SID=abc ;Path=/aaa...aaa` | **`SID=abc ;HttpOnly;Secure;Partitioned;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`** | **`❌`** | `SID=v` | `SID=` | `❌` | `❌` | **`❌`** | **`❌`** | `❌` | `❌` | **`❌`** | **`❌`** | **`❌`** | `SID=abc ⚠️` | **`SID=abc ⚠️`** | **`❌`** | **`❌`** | `data=[nested]` | **`data=<img src=x />`** | **`❌`** |
| rust/kekse (strict) | `SID=abc ⚠️` | `SID=abc ⚠️` | `SID=abc ⚠️` | `SID=abc ⚠️` | `SID=abc ;Secure ⚠️` | `SID=abc ;Path=/b ⚠️` | **`SID=abc ;Secure;Partitioned`** | **`SID=abc ;Partitioned ⚠️`** | **`SID=abc ;Partitioned ⚠️`** | **`SID=abc ;Secure;Partitioned ⚠️`** | `__Secure-SID=abc ;Secure` | `__Secure-SID=abc ⚠️` | `__Host-SID=abc ;Secure;Path=/` | `__Host-SID=abc ;Path=/ ⚠️` | `__Host-SID=abc ;Secure;Path=/;Domain=example.com ⚠️` | `__Host-SID=abc ;Secure;Path=/app ⚠️` | `__host-SID=abc ⚠️` | `__host-SID=abc ;Secure;Path=/ ⚠️` | **`SID=abc ;Secure;Partitioned;SameSite=None`** | **`__Host-SID=abc ;Secure;Partitioned;Path=/`** | **`SID=abc ;Secure;Partitioned;Domain=example.com`** | **`SID=abc ;Secure;Partitioned ⚠️`** | **`SID=abc ;Secure;Partitioned ⚠️`** | **`SID=abc ;Secure;Partitioned`** | `Partitioned=false` | **`SID=abc; Partitioned ;Secure`** | **`❌`** | `❌` | `SID=abc ;SameSite=Strict` | `SID=abc ;SameSite=Lax` | `SID=abc ;SameSite=None` | `SID=abc ;Secure;SameSite=None` | `SID=abc ;SameSite=Lax` | `SID=abc ⚠️` | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ⚠️`** | **`SID=abc ⚠️`** | **`SID=abc ⚠️`** | **`SID=abc ⚠️`** | `SID=abc ⚠️` | **`SID=abc ⚠️`** | **`SID=abc ⚠️`** | **`SID=abc ⚠️`** | **`SID=abc ⚠️`** | **`SID=abc ⚠️`** | `SID=abc ⚠️` | `SID=abc ⚠️` | **`SID=abc ⚠️`** | `SID=abc ⚠️` | `SID=abc ⚠️` | `SID=abc ⚠️` | `SID=abc ⚠️` | `SID=abc ⚠️` | `SID=abc ⚠️` | `SID=abc ⚠️` | `SID=abc ⚠️` | **`SID=abc ;Expires=Mon, 01 Jan 1601 00:00:00 GMT`** | `SID=abc ⚠️` | `SID=abc ⚠️` | **`SID=abc ⚠️`** | **`SID=abc ⚠️`** | `SID=abc ⚠️` | `SID=abc ⚠️` | `SID=abc ⚠️` | `SID=abc ⚠️` | **`SID=abc ⚠️`** | `SID=abc ⚠️` | `SID=abc ⚠️` | `SID=abc ;Domain=.com` | `SID=abc ;Domain=co.uk` | `SID=abc ;Domain=example.co.uk` | `SID=abc ;Domain=xn--mnchen-3ya.de` | **`SID=abc ⚠️`** | **`SID=abc ⚠️`** | `SID=abc ;Domain=xn--hj8h.eu` | `SID=abc ;Domain=xn--` | `SID=abc ;Domain=ex_ample.com` | `SID=abc ;Domain=b.example.com ⚠️` | **`SID=abc ;Domain=valid.example.com ⚠️`** | `SID=abc ;Path=file:///etc/passwd` | **`SID=abc ;Path=`** | `SID=abc ;Path=.` | `SID=abc ;Path=/aaa...aaa` | **`SID=abc ;HttpOnly;Secure;Partitioned;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`** | **`❌`** | `SID=v` | `SID=` | `❌` | `❌` | **`❌`** | **`❌`** | `❌` | `❌` | **`❌`** | **`❌`** | **`❌`** | `SID=abc ⚠️` | **`SID=abc ⚠️`** | **`❌`** | **`❌`** | `data=[nested]` | **`data=<img src=x />`** | **`❌`** |
| rust/kekse (fail-hard) | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`SID=abc ;Secure;Partitioned`** | **`❌`** | **`❌`** | **`❌`** | `__Secure-SID=abc ;Secure` | **`❌`** | `__Host-SID=abc ;Secure;Path=/` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`SID=abc ;Secure;Partitioned;SameSite=None`** | **`__Host-SID=abc ;Secure;Partitioned;Path=/`** | **`SID=abc ;Secure;Partitioned;Domain=example.com`** | **`❌`** | **`❌`** | **`SID=abc ;Secure;Partitioned`** | `Partitioned=false` | **`SID=abc; Partitioned ;Secure`** | **`❌`** | `❌` | `SID=abc ;SameSite=Strict` | `SID=abc ;SameSite=Lax` | `SID=abc ;SameSite=None` | `SID=abc ;Secure;SameSite=None` | `SID=abc ;SameSite=Lax` | **`❌`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | `❌` | `❌` | `❌` | `❌` | **`❌`** | `❌` | `❌` | `❌` | `❌` | `❌` | **`❌`** | **`❌`** | `❌` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`SID=abc ;Expires=Mon, 01 Jan 1601 00:00:00 GMT`** | **`❌`** | **`❌`** | `❌` | `❌` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `❌` | **`❌`** | **`❌`** | `SID=abc ;Domain=.com` | `SID=abc ;Domain=co.uk` | `SID=abc ;Domain=example.co.uk` | `SID=abc ;Domain=xn--mnchen-3ya.de` | `❌` | `❌` | `SID=abc ;Domain=xn--hj8h.eu` | `SID=abc ;Domain=xn--` | `SID=abc ;Domain=ex_ample.com` | **`❌`** | `❌` | `SID=abc ;Path=file:///etc/passwd` | **`SID=abc ;Path=`** | `SID=abc ;Path=.` | `SID=abc ;Path=/aaa...aaa` | **`SID=abc ;HttpOnly;Secure;Partitioned;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`** | **`❌`** | `SID=v` | `SID=` | `❌` | `❌` | **`❌`** | **`❌`** | `❌` | `❌` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `data=[nested]` | **`data=<img src=x />`** | **`❌`** |
| rust/cookie | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc ;Secure` | `SID=abc ;Path=/b` | `SID=abc ;Secure` | `SID=abc` | `SID=abc` | `SID=abc ;Secure` | `__Secure-SID=abc ;Secure` | `__Secure-SID=abc` | `__Host-SID=abc ;Secure;Path=/` | `__Host-SID=abc ;Path=/` | `__Host-SID=abc ;Secure;Path=/;Domain=example.com` | `__Host-SID=abc ;Secure;Path=/app` | `__host-SID=abc` | `__host-SID=abc ;Secure;Path=/` | `SID=abc ;Secure;SameSite=None` | `__Host-SID=abc ;Secure;Path=/` | **`SID=abc ;Secure;Domain=example.com`** | `SID=abc ;Secure` | `SID=abc ;Secure` | `SID=abc ;Secure` | `Partitioned=false` | **`SID=abc; Partitioned ;Secure`** | `SID="abc ;Secure ☢️` | `❌` | `SID=abc ;SameSite=Strict` | `SID=abc ;SameSite=Lax` | `SID=abc ;SameSite=None` | `SID=abc ;Secure;SameSite=None` | `SID=abc ;SameSite=Lax` | `SID=abc` | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | `SID=abc` | **`SID=abc`** | **`SID=abc`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc`** | **`SID=abc`** | `SID=abc` | `SID=abc` | **`SID=abc ;Expires=Mon, 06 Nov 1600 08:49:37 GMT`** | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | **`SID=abc ;Expires=Wed, 01 Jan 1969 00:00:00 GMT`** | **`SID=abc ;Expires=Thu, 01 Jan 1970 00:00:00 GMT`** | **`SID=abc ;Expires=Mon, 01 Jan 1601 00:00:00 GMT`** | `SID=abc` | `SID=abc` | **`SID=abc`** | **`SID=abc`** | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | **`SID=abc`** | `SID=abc` | `SID=abc` | **`SID=abc ;Domain=com`** | `SID=abc ;Domain=co.uk` | `SID=abc ;Domain=example.co.uk` | `SID=abc ;Domain=xn--mnchen-3ya.de` | **`SID=abc ;Domain=münchen.de`** | **`SID=abc ;Domain=🍪.eu`** | `SID=abc ;Domain=xn--hj8h.eu` | `SID=abc ;Domain=xn--` | `SID=abc ;Domain=ex_ample.com` | `SID=abc ;Domain=b.example.com` | **`SID=abc ;Domain=café ☢️`** | `SID=abc ;Path=file:///etc/passwd` | **`SID=abc ;Path=`** | `SID=abc ;Path=.` | `SID=abc ;Path=/aaa...aaa` | **`SID=abc ;HttpOnly;Secure;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`** | `SID=a\r\nb ☢️` | `SID=v` | `SID=` | **`SID=a\0b ☢️`** | **`SID=a\x01b ☢️`** | `SID=a"b ☢️` | **`SID=café ☢️`** | `❌` | `❌` | **`naïve=v ☢️`** | `S ID=abc ☢️` | `SID=a\x7fb ☢️` | `SID=abc` | `SID=abc ;Path=/a\0b` | `token[]=nested ☢️` | `data={"testdata":"JSON"} ☢️` | `data=[nested]` | `data="<img src=x />" ☢️` | `"sid=surrounded-b…<26 chars> ;Secure ☢️` |
| rust/cookie_store | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc ;Secure` | `SID=abc ;Path=/b` | `SID=abc ;Secure` | `SID=abc` | `SID=abc` | `SID=abc ;Secure` | `__Secure-SID=abc ;Secure` | `__Secure-SID=abc` | `__Host-SID=abc ;Secure;Path=/` | `__Host-SID=abc ;Path=/` | `__Host-SID=abc ;Secure;Path=/;Domain=example.com` | `__Host-SID=abc ;Secure;Path=/app` | `__host-SID=abc` | `__host-SID=abc ;Secure;Path=/` | `SID=abc ;Secure;SameSite=None` | `__Host-SID=abc ;Secure;Path=/` | **`SID=abc ;Secure;Domain=example.com`** | `SID=abc ;Secure` | `SID=abc ;Secure` | `SID=abc ;Secure` | `Partitioned=false` | `SID=abc%3B%20Partitioned ;Secure ☢️` | `SID="abc ;Secure ☢️` | `❌` | `SID=abc ;SameSite=Strict` | `SID=abc ;SameSite=Lax` | `SID=abc ;SameSite=None` | `SID=abc ;Secure;SameSite=None` | `SID=abc ;SameSite=Lax` | `SID=abc` | `❌` | `❌` | `❌` | **`SID=abc`** | `❌` | `SID=abc` | **`SID=abc`** | **`SID=abc`** | `❌` | **`SID=abc`** | **`SID=abc`** | `SID=abc` | `SID=abc` | `❌` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | **`❌`** | **`❌`** | `❌` | `SID=abc` | `SID=abc` | **`SID=abc`** | **`SID=abc`** | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | **`SID=abc`** | `SID=abc` | `SID=abc` | **`SID=abc ;Domain=com`** | **`❌`** | **`❌`** | **`❌`** | `❌` | `❌` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `❌` | `SID=abc ;Path=file:///etc/passwd` | **`SID=abc ;Path=`** | `SID=abc ;Path=.` | `SID=abc ;Path=/aaa...aaa` | **`SID=abc ;HttpOnly;Secure;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`** | `SID=a\r\nb ☢️` | `SID=v` | `SID=` | **`SID=a\0b ☢️`** | **`SID=a\x01b ☢️`** | `SID=a"b ☢️` | **`SID=café ☢️`** | `❌` | `❌` | **`naïve=v ☢️`** | `S ID=abc ☢️` | `SID=a\x7fb ☢️` | `SID=abc` | `SID=abc ;Path=/a\0b` | `token[]=nested ☢️` | `data={"testdata":"JSON"} ☢️` | `data=[nested]` | `data="<img src=x />" ☢️` | `"sid=surrounded-b…<26 chars> ;Secure ☢️` |
| python/SimpleCookie | `SID=abc` | **`❌`** | `SID=abc` | **`SID=abc ;SameSite=Bogus ☢️`** | `SID=abc ;Secure` | `SID=abc ;Path=/b` | **`❌`** | **`❌`** | `SID=abc` | **`❌`** | `__Secure-SID=abc ;Secure` | `__Secure-SID=abc` | `__Host-SID=abc ;Secure;Path=/` | `__Host-SID=abc ;Path=/` | `__Host-SID=abc ;Secure;Path=/;Domain=example.com` | `__Host-SID=abc ;Secure;Path=/app` | `__host-SID=abc` | `__host-SID=abc ;Secure;Path=/` | **`❌`** | **`❌`** | `❌` | `SID=abc ;Secure` | `SID=abc ;Secure` | **`❌`** | `Partitioned=false` | `SID=abc%3B%20Partitioned ;Secure ☢️` | **`SID=abc; Partitioned ;Secure ☢️`** | `❌` | `SID=abc ;SameSite=Strict` | `SID=abc ;SameSite=Lax` | `SID=abc ;SameSite=None` | `SID=abc ;Secure;SameSite=None` | **`SID=abc ;SameSite=lAx`** | `SID=abc` | **`SID=abc`** | **`SID=abc`** | `❌` | `❌` | **`SID=abc`** | `SID=abc` | `❌` | `❌` | **`SID=abc`** | `❌` | `❌` | `SID=abc` | `SID=abc` | **`SID=abc`** | `SID=abc` | `SID=abc` | `SID=abc` | **`❌`** | **`❌`** | `SID=abc` | `SID=abc` | `SID=abc` | **`SID=abc`** | `SID=abc` | `SID=abc` | **`SID=abc`** | `❌` | **`❌`** | **`❌`** | **`❌`** | `SID=abc` | `❌` | `SID=abc ⚠️` | **`❌`** | `SID=abc ;Domain=.com` | `SID=abc ;Domain=co.uk` | `SID=abc ;Domain=example.co.uk` | `SID=abc ;Domain=xn--mnchen-3ya.de` | **`SID=abc`** | **`SID=abc`** | `SID=abc ;Domain=xn--hj8h.eu` | `SID=abc ;Domain=xn--` | `SID=abc ;Domain=ex_ample.com` | `SID=abc ;Domain=b.example.com` | **`SID=abc ;Domain=valid.example.com`** | `SID=abc ;Path=file:///etc/passwd` | `SID=abc` | `SID=abc ;Path=.` | `SID=abc ;Path=/aaa...aaa` | `❌` | **`❌`** | `SID=v` | `SID=` | `❌` | `❌` | **`❌`** | **`❌`** | `❌` | `❌` | **`❌`** | **`❌`** | **`❌`** | `SID=abc` | **`SID=abc`** | **`❌`** | **`❌`** | `data=[nested]` | **`data=<img src=x />`** | **`❌`** |
| python/http.cookiejar | `SID=abc` | `SID=abc` | **`❌`** | **`SID=abc ;SameSite=Bogus ☢️`** | `SID=abc ;Secure` | **`SID=abc ;Path=/a ☢️`** | **`SID=abc ;Secure;Partitioned`** | **`SID=abc ;Partitioned`** | **`SID=abc ;Partitioned`** | **`SID=abc ;Secure;Partitioned`** | `__Secure-SID=abc ;Secure` | `__Secure-SID=abc` | `__Host-SID=abc ;Secure;Path=/` | `__Host-SID=abc ;Path=/` | **`__Host-SID=abc ;Secure;Path=/;Domain=.example.com`** | `__Host-SID=abc ;Secure;Path=/app` | `__host-SID=abc` | `__host-SID=abc ;Secure;Path=/` | **`SID=abc ;Secure;Partitioned;SameSite=None`** | **`__Host-SID=abc ;Secure;Partitioned;Path=/`** | **`SID=abc ;Secure;Partitioned;Domain=.example.com`** | **`SID=abc ;Secure;Partitioned`** | **`SID=abc ;Secure;Partitioned`** | `SID=abc ;Secure` | `Partitioned=false` | `SID=abc%3B%20Partitioned ;Secure ☢️` | `SID="abc ;Secure ☢️` | **`Partitioned= ☢️`** | `SID=abc ;SameSite=Strict` | `SID=abc ;SameSite=Lax` | `SID=abc ;SameSite=None` | `SID=abc ;Secure;SameSite=None` | **`SID=abc ;SameSite=lAx`** | `SID=abc` | `❌` | `❌` | **`SID=abc`** | `❌` | `❌` | `SID=abc` | `❌` | **`SID=abc`** | `❌` | `❌` | **`SID=abc`** | `SID=abc` | **`❌`** | **`SID=abc`** | `SID=abc` | **`❌`** | `SID=abc` | **`❌`** | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | **`SID=abc`** | **`❌`** | **`❌`** | `❌` | **`SID=abc`** | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | **`SID=abc`** | **`❌`** | `SID=abc` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `❌` | `❌` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `❌` | `SID=abc ;Path=file:///etc/passwd` | `SID=abc` | `SID=abc ;Path=.` | `SID=abc ;Path=/aaa...aaa` | **`SID=abc ;HttpOnly;Secure;Partitioned;SameSite=Lax;Path=/p;Domain=.example.com`** | `SID=a\r\nb ☢️` | `SID=v` | `SID=` | **`SID=a\0b ☢️`** | **`SID=a\x01b ☢️`** | `SID=a"b ☢️` | `SID=café ☢️` | **`justvalue= ☢️`** | `❌` | `naïve=v ☢️` | `S ID=abc ☢️` | `SID=a\x7fb ☢️` | `SID=abc` | **`SID=abc ;Path=/a%00b`** | `token[]=nested ☢️` | `data={"testdata":"JSON"} ☢️` | `data=[nested]` | `data="<img src=x />" ☢️` | `"sid=surrounded-b…<26 chars> ;Secure ☢️` |
| python/mitmproxy | `SID=abc` | `SID=abc` | `SID=abc` | **`SID=abc ;SameSite=Bogus ☢️`** | `SID=abc ;Secure` | `SID=abc ;Path=/b` | **`SID=abc ;Secure;Partitioned`** | **`SID=abc ;Partitioned`** | **`SID=abc ;Partitioned`** | **`SID=abc ;Secure;Partitioned`** | `__Secure-SID=abc ;Secure` | `__Secure-SID=abc` | `__Host-SID=abc ;Secure;Path=/` | `__Host-SID=abc ;Path=/` | `__Host-SID=abc ;Secure;Path=/;Domain=example.com` | `__Host-SID=abc ;Secure;Path=/app` | `__host-SID=abc` | `__host-SID=abc ;Secure;Path=/` | **`SID=abc ;Secure;Partitioned;SameSite=None`** | **`__Host-SID=abc ;Secure;Partitioned;Path=/`** | **`SID=abc ;Secure;Partitioned;Domain=example.com`** | **`SID=abc ;Secure;Partitioned`** | **`SID=abc ;Secure;Partitioned`** | **`SID=abc ;Secure;Partitioned`** | `Partitioned=false` | `SID=abc%3B%20Partitioned ;Secure ☢️` | **`SID=abc; Partitioned ;Secure ☢️`** | **`Partitioned= ☢️`** | `SID=abc ;SameSite=Strict` | `SID=abc ;SameSite=Lax` | `SID=abc ;SameSite=None` | `SID=abc ;Secure;SameSite=None` | **`SID=abc ;SameSite=lAx`** | **`SID=abc ;SameSite= ☢️`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | `SID=abc` | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | `SID=abc` | `SID=abc` | **`SID=abc`** | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | **`SID=abc`** | `SID=abc` | `SID=abc` | **`SID=abc`** | **`SID=abc`** | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | **`SID=abc`** | `SID=abc` | `SID=abc` | `SID=abc ;Domain=.com` | `SID=abc ;Domain=co.uk` | `SID=abc ;Domain=example.co.uk` | `SID=abc ;Domain=xn--mnchen-3ya.de` | **`SID=abc ;Domain=münchen.de`** | **`SID=abc ;Domain=ð\x9f\x8dª.eu`** | `SID=abc ;Domain=xn--hj8h.eu` | `SID=abc ;Domain=xn--` | `SID=abc ;Domain=ex_ample.com` | `SID=abc ;Domain=b.example.com` | **`SID=abc ;Domain=café ☢️`** | `SID=abc ;Path=file:///etc/passwd` | **`SID=abc ;Path=`** | `SID=abc ;Path=.` | `SID=abc ;Path=/aaa...aaa` | **`SID=abc ;HttpOnly;Secure;Partitioned;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`** | `SID=a\r\nb ☢️` | **`SID  =  v   ☢️`** | `SID=` | **`SID=a\0b ☢️`** | **`SID=a\x01b ☢️`** | `SID=a"b ☢️` | `SID=café ☢️` | **`justvalue= ☢️`** | **`=v ☢️`** | `naïve=v ☢️` | `S ID=abc ☢️` | `SID=a\x7fb ☢️` | `SID=abc` | `SID=abc ;Path=/a\0b` | `token[]=nested ☢️` | `data={"testdata":"JSON"} ☢️` | `data=[nested]` | **`data=<img src=x />`** | **`"sid=surrounded-b…<27 chars> ;Secure ☢️`** |
| node/tough-cookie | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc ;Secure` | `SID=abc ;Path=/b` | **`SID=abc ;Secure;Partitioned`** | **`SID=abc ;Partitioned`** | **`SID=abc ;Partitioned`** | **`SID=abc ;Secure;Partitioned`** | `__Secure-SID=abc ;Secure` | `__Secure-SID=abc` | `__Host-SID=abc ;Secure;Path=/` | `__Host-SID=abc ;Path=/` | `__Host-SID=abc ;Secure;Path=/;Domain=example.com` | `__Host-SID=abc ;Secure;Path=/app` | `__host-SID=abc` | `__host-SID=abc ;Secure;Path=/` | **`SID=abc ;Secure;Partitioned;SameSite=none`** | **`__Host-SID=abc ;Secure;Partitioned;Path=/`** | **`SID=abc ;Secure;Partitioned;Domain=example.com`** | **`SID=abc ;Secure;Partitioned`** | **`SID=abc ;Secure;Partitioned`** | **`SID=abc ;Secure;Partitioned`** | `Partitioned=false` | `SID=abc%3B%20Partitioned ;Secure ☢️` | `SID="abc ;Secure ☢️` | `❌` | **`SID=abc ;SameSite=strict`** | **`SID=abc ;SameSite=lax`** | **`SID=abc ;SameSite=none`** | **`SID=abc ;Secure;SameSite=none`** | **`SID=abc ;SameSite=lax`** | `SID=abc` | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | `SID=abc` | **`SID=abc ;Expires=Thu, 03 Mar 1994 00:00:00 GMT`** | **`SID=abc`** | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | **`SID=abc ;Expires=Tue, 01 Jan 2069 00:00:00 GMT`** | **`SID=abc ;Expires=Thu, 01 Jan 1970 00:00:00 GMT`** | **`SID=abc ;Expires=Mon, 01 Jan 1601 00:00:00 GMT`** | `SID=abc` | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | `SID=abc` | `SID=abc` | `SID=abc` | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Wed, 08 Nov 2006 07:00:00 GMT`** | **`SID=abc ;Domain=com`** | `SID=abc ;Domain=co.uk` | `SID=abc ;Domain=example.co.uk` | `SID=abc ;Domain=xn--mnchen-3ya.de` | **`SID=abc ;Domain=mã¼nchen.de`** | **`SID=abc ;Domain=ð\x9f\x8dª.eu`** | `SID=abc ;Domain=xn--hj8h.eu` | `SID=abc ;Domain=xn--` | `SID=abc ;Domain=ex_ample.com` | `SID=abc ;Domain=b.example.com` | **`SID=abc ;Domain=cafã© ☢️`** | **`SID=abc`** | `SID=abc` | **`SID=abc`** | `SID=abc ;Path=/aaa...aaa` | **`SID=abc ;HttpOnly;Secure;Partitioned;SameSite=lax;Path=/p;Domain=example.com;Max-Age=60`** | **`SID=a ☢️`** | `SID=v` | `SID=` | **`SID=a ☢️`** | `❌` | `SID=a"b ☢️` | `SID=café ☢️` | `❌` | `❌` | `naïve=v ☢️` | `S ID=abc ☢️` | `SID=a\x7fb ☢️` | `SID=abc` | `SID=abc ;Path=/a\0b` | `token[]=nested ☢️` | `data={"testdata":"JSON"} ☢️` | `data=[nested]` | `data="<img src=x />" ☢️` | `"sid=surrounded-b…<26 chars> ;Secure ☢️` |
| node/set-cookie-parser | `SID=abc` | `SID=abc` | `SID=abc` | **`SID=abc ;SameSite=Bogus ☢️`** | `SID=abc ;Secure` | `SID=abc ;Path=/b` | **`SID=abc ;Secure;Partitioned`** | **`SID=abc ;Partitioned`** | **`SID=abc ;Partitioned`** | **`SID=abc ;Secure;Partitioned`** | `__Secure-SID=abc ;Secure` | `__Secure-SID=abc` | `__Host-SID=abc ;Secure;Path=/` | `__Host-SID=abc ;Path=/` | `__Host-SID=abc ;Secure;Path=/;Domain=example.com` | `__Host-SID=abc ;Secure;Path=/app` | `__host-SID=abc` | `__host-SID=abc ;Secure;Path=/` | **`SID=abc ;Secure;Partitioned;SameSite=None`** | **`__Host-SID=abc ;Secure;Partitioned;Path=/`** | **`SID=abc ;Secure;Partitioned;Domain=example.com`** | **`SID=abc ;Secure;Partitioned`** | **`SID=abc ;Secure;Partitioned`** | **`SID=abc ;Secure;Partitioned`** | `Partitioned=false` | **`SID=abc; Partitioned ;Secure`** | `SID="abc ;Secure ☢️` | `❌` | `SID=abc ;SameSite=Strict` | `SID=abc ;SameSite=Lax` | `SID=abc ;SameSite=None` | `SID=abc ;Secure;SameSite=None` | **`SID=abc ;SameSite=lAx`** | `SID=abc` | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | `SID=abc` | **`SID=abc ;Expires=Thu, 03 Mar 1994 00:00:00 GMT`** | **`SID=abc ;Expires=Mon, 06 Nov 1600 08:49:37 GMT`** | `SID=abc` | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:00 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sat, 11 Jun 1994 08:49:37 GMT`** | `SID=abc` | **`SID=abc ;Expires=Wed, 01 Jan 1969 00:00:00 GMT`** | **`SID=abc ;Expires=Thu, 01 Jan 1970 00:00:00 GMT`** | **`SID=abc ;Expires=Mon, 01 Jan 1601 00:00:00 GMT`** | **`SID=abc ;Expires=Mon, 07 Nov 1994 00:00:00 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | `SID=abc` | **`SID=abc ;Expires=567105180577`** | **`SID=abc ;Expires=Tue, 06 Nov 2001 08:49:37 GMT`** | `SID=abc` | **`SID=abc ;Expires=Sun, 06 Nov 1994 07:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | `SID=abc` | `SID=abc ;Domain=.com` | `SID=abc ;Domain=co.uk` | `SID=abc ;Domain=example.co.uk` | `SID=abc ;Domain=xn--mnchen-3ya.de` | **`SID=abc ;Domain=münchen.de`** | **`SID=abc ;Domain=ð\x9f\x8dª.eu`** | `SID=abc ;Domain=xn--hj8h.eu` | `SID=abc ;Domain=xn--` | `SID=abc ;Domain=ex_ample.com` | `SID=abc ;Domain=b.example.com` | **`SID=abc ;Domain=café ☢️`** | `SID=abc ;Path=file:///etc/passwd` | `SID=abc` | `SID=abc ;Path=.` | `SID=abc ;Path=/aaa...aaa` | **`SID=abc ;HttpOnly;Secure;Partitioned;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`** | `SID=a\r\nb ☢️` | **`  SID  =  v   ☢️`** | `SID=` | **`SID=a\0b ☢️`** | **`SID=a\x01b ☢️`** | `SID=a"b ☢️` | `SID=café ☢️` | `❌` | `❌` | `naïve=v ☢️` | `S ID=abc ☢️` | `SID=a\x7fb ☢️` | `SID=abc` | `SID=abc ;Path=/a\0b` | `token[]=nested ☢️` | `data={"testdata":"JSON"} ☢️` | `data=[nested]` | `data="<img src=x />" ☢️` | **`"sid=surrounded-b…<27 chars> ;Secure ☢️`** |
| go/net/http | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc ;Secure` | `SID=abc ;Path=/b` | **`SID=abc ;Secure;Partitioned`** | **`SID=abc ;Partitioned`** | **`SID=abc ;Partitioned`** | **`SID=abc ;Secure;Partitioned`** | `__Secure-SID=abc ;Secure` | `__Secure-SID=abc` | `__Host-SID=abc ;Secure;Path=/` | `__Host-SID=abc ;Path=/` | `__Host-SID=abc ;Secure;Path=/;Domain=example.com` | `__Host-SID=abc ;Secure;Path=/app` | `__host-SID=abc` | `__host-SID=abc ;Secure;Path=/` | **`SID=abc ;Secure;Partitioned;SameSite=None`** | **`__Host-SID=abc ;Secure;Partitioned;Path=/`** | **`SID=abc ;Secure;Partitioned;Domain=example.com`** | **`SID=abc ;Secure;Partitioned`** | **`SID=abc ;Secure;Partitioned`** | **`SID=abc ;Secure;Partitioned`** | `Partitioned=false` | `SID=abc%3B%20Partitioned ;Secure ☢️` | **`❌`** | `❌` | `SID=abc ;SameSite=Strict` | `SID=abc ;SameSite=Lax` | `SID=abc ;SameSite=None` | `SID=abc ;Secure;SameSite=None` | `SID=abc ;SameSite=Lax` | `SID=abc` | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | `SID=abc` | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | `SID=abc` | `SID=abc` | **`SID=abc ;Expires=Mon, 06 Nov 1600 08:49:37 GMT`** | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | **`SID=abc ;Expires=Mon, 01 Jan 1601 00:00:00 GMT`** | `SID=abc` | `SID=abc` | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc`** | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | **`SID=abc`** | `SID=abc` | `SID=abc` | `SID=abc ;Domain=.com` | `SID=abc ;Domain=co.uk` | `SID=abc ;Domain=example.co.uk` | `SID=abc ;Domain=xn--mnchen-3ya.de` | **`SID=abc`** | **`SID=abc`** | `SID=abc ;Domain=xn--hj8h.eu` | `SID=abc ;Domain=xn--` | `SID=abc ;Domain=ex_ample.com` | `SID=abc ;Domain=b.example.com` | **`SID=abc ;Domain=valid.example.com`** | `SID=abc ;Path=file:///etc/passwd` | `SID=abc` | `SID=abc ;Path=.` | `SID=abc ;Path=/aaa...aaa` | **`SID=abc ;HttpOnly;Secure;Partitioned;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`** | **`❌`** | **`SID=  v ☢️`** | `SID=` | `❌` | `❌` | **`❌`** | **`❌`** | `❌` | `❌` | **`❌`** | **`❌`** | **`❌`** | `SID=abc` | **`SID=abc`** | **`❌`** | **`❌`** | `data=[nested]` | **`data=<img src=x />`** | **`❌`** |
| dotnet/Microsoft.Net.Http.Headers | `SID=abc` | `SID=abc` | **`❌`** | `SID=abc` | **`❌`** | `SID=abc ;Path=/b` | `SID=abc ;Secure` | `SID=abc` | `SID=abc` | `SID=abc ;Secure` | `__Secure-SID=abc ;Secure` | `__Secure-SID=abc` | `__Host-SID=abc ;Secure;Path=/` | `__Host-SID=abc ;Path=/` | `__Host-SID=abc ;Secure;Path=/;Domain=example.com` | `__Host-SID=abc ;Secure;Path=/app` | `__host-SID=abc` | `__host-SID=abc ;Secure;Path=/` | `SID=abc ;Secure;SameSite=None` | `__Host-SID=abc ;Secure;Path=/` | **`SID=abc ;Secure;Domain=example.com`** | `SID=abc ;Secure` | `SID=abc ;Secure` | `SID=abc ;Secure` | `Partitioned=false` | `SID=abc%3B%20Partitioned ;Secure ☢️` | **`SID= ;Secure ☢️`** | `❌` | `SID=abc ;SameSite=Strict` | `SID=abc ;SameSite=Lax` | `SID=abc ;SameSite=None` | `SID=abc ;Secure;SameSite=None` | `SID=abc ;SameSite=Lax` | `SID=abc` | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | `❌` | **`❌`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | `❌` | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | `❌` | `❌` | **`❌`** | **`❌`** | `❌` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`SID=abc ;Expires=Thu, 01 Jan 1970 00:00:00 GMT`** | **`SID=abc ;Expires=Mon, 01 Jan 1601 00:00:00 GMT`** | **`❌`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | `❌` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `❌` | **`SID=abc ;Expires=Sun, 06 Nov 1994 08:49:37 GMT`** | **`❌`** | `SID=abc ;Domain=.com` | `SID=abc ;Domain=co.uk` | `SID=abc ;Domain=example.co.uk` | `SID=abc ;Domain=xn--mnchen-3ya.de` | **`SID=abc ;Domain=münchen.de`** | **`SID=abc ;Domain=ð\x9f\x8dª.eu`** | `SID=abc ;Domain=xn--hj8h.eu` | `SID=abc ;Domain=xn--` | `SID=abc ;Domain=ex_ample.com` | `SID=abc ;Domain=b.example.com` | **`SID=abc ;Domain=café ☢️`** | `SID=abc ;Path=file:///etc/passwd` | **`SID=abc ;Path=`** | `SID=abc ;Path=.` | `SID=abc ;Path=/aaa...aaa` | **`SID=abc ;HttpOnly;Secure;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`** | **`❌`** | **`❌`** | `SID=` | `❌` | `❌` | **`❌`** | **`❌`** | `❌` | `❌` | **`❌`** | **`❌`** | **`❌`** | `SID=abc` | `SID=abc ;Path=/a\0b` | **`❌`** | **`❌`** | `data=[nested]` | **`❌`** | **`❌`** |
| nginx/proxy (Set-Cookie) | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≠ SID=a%0D%0Ab` | `≠ SID  =  v` | `≡` | `≠ SID=a%00b` | `≠ SID=a%01b` | `≡` | `≡` | `≡` | `≡` | `≡` | `≡` | `≠ SID=a%7Fb` | `≠ SID=abc; Pa%00th=/` | `≠ SID=abc; Path=/a%00b` | `≡` | `≡` | `≡` | `≡` | `≡` |
| java/Jakarta RESTEasy | `SID=abc` | `SID=abc` | **`❌`** | **`❌`** | `SID=abc ;Secure` | `SID=abc ;Path=/b` | `SID=abc ;Secure` | `SID=abc` | `SID=abc` | `SID=abc ;Secure` | `__Secure-SID=abc ;Secure` | `__Secure-SID=abc` | `__Host-SID=abc ;Secure;Path=/` | `__Host-SID=abc ;Path=/` | `__Host-SID=abc ;Secure;Path=/;Domain=example.com` | `__Host-SID=abc ;Secure;Path=/app` | `__host-SID=abc` | `__host-SID=abc ;Secure;Path=/` | `SID=abc ;Secure;SameSite=None` | `__Host-SID=abc ;Secure;Path=/` | **`SID=abc ;Secure;Domain=example.com`** | `SID=abc ;Secure` | `SID=abc ;Secure` | `SID=abc ;Secure` | `Partitioned=false` | `SID=abc%3B%20Partitioned ;Secure ☢️` | **`SID=abc; Partitioned ;Secure ☢️`** | **`Partitioned= ☢️`** | `SID=abc ;SameSite=Strict` | `SID=abc ;SameSite=Lax` | `SID=abc ;SameSite=None` | `SID=abc ;Secure;SameSite=None` | `SID=abc ;SameSite=Lax` | **`❌`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | `SID=abc` | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | `SID=abc` | `SID=abc` | **`SID=abc`** | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | **`SID=abc`** | `SID=abc` | `SID=abc` | **`SID=abc`** | **`SID=abc`** | `SID=abc` | `SID=abc` | `SID=abc` | **`❌`** | **`SID=abc`** | `SID=abc` | `SID=abc` | `SID=abc ;Domain=.com` | `SID=abc ;Domain=co.uk` | `SID=abc ;Domain=example.co.uk` | `SID=abc ;Domain=xn--mnchen-3ya.de` | **`SID=abc ;Domain=münchen.de`** | **`SID=abc ;Domain=ð\x9f\x8dª.eu`** | `SID=abc ;Domain=xn--hj8h.eu` | `SID=abc ;Domain=xn--` | `SID=abc ;Domain=ex_ample.com` | `SID=abc ;Domain=b.example.com` | **`SID=abc ;Domain=café ☢️`** | `SID=abc ;Path=file:///etc/passwd` | `SID=abc` | `SID=abc ;Path=.` | `SID=abc ;Path=/aaa...aaa` | **`SID=abc ;HttpOnly;Secure;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`** | `SID=a\r\nb ☢️` | `SID=v` | `SID=` | **`SID=a\0b ☢️`** | **`SID=a\x01b ☢️`** | `SID=a"b ☢️` | `SID=café ☢️` | **`justvalue= ☢️`** | `❌` | `naïve=v ☢️` | `S ID=abc ☢️` | `SID=a\x7fb ☢️` | `SID=abc` | `SID=abc ;Path=/a\0b` | `token[]=nested ☢️` | `data={"testdata":"JSON"} ☢️` | `data=[nested]` | **`data=<img src=x />`** | **`"sid=surrounded-b…<35 chars> ☢️`** |
| java/Jakarta Jersey | `SID=abc` | `SID=abc` | **`❌`** | **`❌`** | `SID=abc ;Secure` | `SID=abc ;Path=/b` | `SID=abc ;Secure` | `SID=abc` | `SID=abc` | `SID=abc ;Secure` | `__Secure-SID=abc ;Secure` | `__Secure-SID=abc` | `__Host-SID=abc ;Secure;Path=/` | `__Host-SID=abc ;Path=/` | `__Host-SID=abc ;Secure;Path=/;Domain=example.com` | `__Host-SID=abc ;Secure;Path=/app` | `__host-SID=abc` | `__host-SID=abc ;Secure;Path=/` | `SID=abc ;Secure;SameSite=None` | `__Host-SID=abc ;Secure;Path=/` | **`SID=abc ;Secure;Domain=example.com`** | `SID=abc ;Secure` | `SID=abc ;Secure` | `SID=abc ;Secure` | `Partitioned=false` | `SID=abc%3B%20Partitioned ;Secure ☢️` | `SID="abc ;Secure ☢️` | **`Partitioned= ☢️`** | `SID=abc ;SameSite=Strict` | `SID=abc ;SameSite=Lax` | `SID=abc ;SameSite=None` | `SID=abc ;Secure;SameSite=None` | `SID=abc ;SameSite=Lax` | **`❌`** | **`SID=abc`** | **`SID=abc`** | `❌` | `❌` | **`SID=abc`** | `SID=abc` | **`SID=abc`** | `❌` | **`SID=abc`** | **`SID=abc`** | `❌` | **`❌`** | `SID=abc` | **`SID=abc`** | `SID=abc` | `SID=abc` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `SID=abc` | `SID=abc` | **`SID=abc`** | `SID=abc` | `SID=abc` | **`SID=abc`** | `❌` | **`❌`** | **`❌`** | `SID=abc` | **`❌`** | **`SID=abc`** | `SID=abc` | **`❌`** | `SID=abc ;Domain=.com` | `SID=abc ;Domain=co.uk` | `SID=abc ;Domain=example.co.uk` | `SID=abc ;Domain=xn--mnchen-3ya.de` | **`SID=abc ;Domain=münchen.de`** | **`SID=abc ;Domain=ð\x9f\x8dª.eu`** | `SID=abc ;Domain=xn--hj8h.eu` | `SID=abc ;Domain=xn--` | `SID=abc ;Domain=ex_ample.com` | `SID=abc ;Domain=b.example.com` | **`SID=abc ;Domain=café ☢️`** | `SID=abc ;Path=file:///etc/passwd` | **`SID=abc ;Path=`** | `SID=abc ;Path=.` | `SID=abc ;Path=/aaa...aaa` | **`SID=abc ;HttpOnly;Secure;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`** | `SID=a\r\nb ☢️` | `SID=v` | `SID=` | **`SID=a\0b ☢️`** | **`SID=a\x01b ☢️`** | `SID=a"b ☢️` | `SID=café ☢️` | **`justvalue= ☢️`** | **`=v ☢️`** | `naïve=v ☢️` | `S ID=abc ☢️` | `SID=a\x7fb ☢️` | `SID=abc` | `SID=abc ;Path=/a\0b` | `token[]=nested ☢️` | `data={"testdata":"JSON"} ☢️` | `data=[nested]` | **`data=<img src=x />`** | `"sid=surrounded-b…<26 chars> ;Secure ☢️` |
| java/java.net.HttpCookie | `SID=abc` | `SID=abc` | **`❌`** | `SID=abc` | `SID=abc ;Secure` | **`SID=abc ;Path=/a ☢️`** | `SID=abc ;Secure` | `SID=abc` | `SID=abc` | `SID=abc ;Secure` | `__Secure-SID=abc ;Secure` | `__Secure-SID=abc` | `__Host-SID=abc ;Secure;Path=/` | `__Host-SID=abc ;Path=/` | `__Host-SID=abc ;Secure;Path=/;Domain=example.com` | `__Host-SID=abc ;Secure;Path=/app` | `__host-SID=abc` | `__host-SID=abc ;Secure;Path=/` | **`SID=abc ;Secure`** | `__Host-SID=abc ;Secure;Path=/` | **`SID=abc ;Secure;Domain=example.com`** | `SID=abc ;Secure` | `SID=abc ;Secure` | `SID=abc ;Secure` | `Partitioned=false` | `SID=abc%3B%20Partitioned ;Secure ☢️` | `SID="abc ;Secure ☢️` | `❌` | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc ;Secure`** | **`SID=abc`** | `SID=abc` | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | `SID=abc` | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | `SID=abc` | `SID=abc` | **`SID=abc`** | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | **`SID=abc`** | `SID=abc` | `SID=abc` | **`SID=abc`** | **`SID=abc`** | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | **`SID=abc`** | `SID=abc` | `SID=abc` | `SID=abc ;Domain=.com` | `SID=abc ;Domain=co.uk` | `SID=abc ;Domain=example.co.uk` | `SID=abc ;Domain=xn--mnchen-3ya.de` | **`SID=abc ;Domain=mã¼nchen.de`** | **`SID=abc ;Domain=ð\x9f\x8dª.eu`** | `SID=abc ;Domain=xn--hj8h.eu` | `SID=abc ;Domain=xn--` | `SID=abc ;Domain=ex_ample.com` | **`SID=abc ;Domain=a.example.com ☢️`** | **`SID=abc ;Domain=valid.example.com`** | `SID=abc ;Path=file:///etc/passwd` | **`SID=abc ;Path=`** | `SID=abc ;Path=.` | `SID=abc ;Path=/aaa...aaa` | **`SID=abc ;HttpOnly;Secure;Path=/p;Domain=example.com;Max-Age=60`** | `SID=a\r\nb ☢️` | `SID=v` | `SID=` | **`SID=a\0b ☢️`** | **`SID=a\x01b ☢️`** | `SID=a"b ☢️` | `SID=café ☢️` | `❌` | `❌` | **`❌`** | **`❌`** | `SID=a\x7fb ☢️` | `SID=abc` | `SID=abc ;Path=/a\0b` | `token[]=nested ☢️` | `data={"testdata":"JSON"} ☢️` | `data=[nested]` | **`data=<img src=x />`** | `"sid=surrounded-b…<26 chars> ;Secure ☢️` |
| java/Apache HttpClient5 | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;SameSite=Bogus;Domain=example.com ☢️`** | **`SID=abc ;Secure;Domain=example.com`** | **`SID=abc ;Path=/b;Domain=example.com`** | **`SID=abc ;Secure;Domain=example.com`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Secure;Domain=example.com`** | **`__Secure-SID=abc ;Secure;Domain=example.com`** | **`__Secure-SID=abc ;Domain=example.com`** | **`__Host-SID=abc ;Secure;Path=/;Domain=example.com`** | **`__Host-SID=abc ;Path=/;Domain=example.com`** | `__Host-SID=abc ;Secure;Path=/;Domain=example.com` | **`__Host-SID=abc ;Secure;Path=/app;Domain=example.com`** | **`__host-SID=abc ;Domain=example.com`** | **`__host-SID=abc ;Secure;Path=/;Domain=example.com`** | **`SID=abc ;Secure;SameSite=None;Domain=example.com`** | **`__Host-SID=abc ;Secure;Path=/;Domain=example.com`** | **`SID=abc ;Secure;Domain=example.com`** | **`SID=abc ;Secure;Domain=example.com`** | **`SID=abc ;Secure;Domain=example.com`** | **`SID=abc ;Secure;Domain=example.com`** | **`Partitioned=false ;Domain=example.com`** | **`SID=abc%3B%20Partitioned ;Secure;Domain=example.com ☢️`** | **`SID=abc; Partitioned ;Secure;Domain=example.com ☢️`** | `❌` | **`SID=abc ;SameSite=Strict;Domain=example.com`** | **`SID=abc ;SameSite=Lax;Domain=example.com`** | **`SID=abc ;SameSite=None;Domain=example.com`** | **`SID=abc ;Secure;SameSite=None;Domain=example.com`** | **`SID=abc ;SameSite=lAx;Domain=example.com`** | **`SID=abc ;SameSite=;Domain=example.com ☢️`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Domain=example.com`** | **`❌`** | **`❌`** | `❌` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Domain=example.com`** | **`❌`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Domain=example.com`** | **`❌`** | **`❌`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Domain=com`** | **`SID=abc ;Domain=co.uk`** | **`SID=abc ;Domain=example.co.uk`** | **`SID=abc ;Domain=xn--mnchen-3ya.de`** | **`SID=abc ;Domain=mã¼nchen.de`** | **`SID=abc ;Domain=ð\x9f\x8dª.eu`** | **`SID=abc ;Domain=xn--hj8h.eu`** | **`SID=abc ;Domain=xn--`** | **`SID=abc ;Domain=ex_ample.com`** | **`SID=abc ;Domain=b.example.com`** | **`SID=abc ;Domain=cafã© ☢️`** | **`SID=abc ;Path=file:///etc/passwd;Domain=example.com`** | **`SID=abc ;Path⇒default;Domain=example.com`** | **`SID=abc ;Path=.;Domain=example.com`** | **`SID=abc ;Path=/aaa...aaa;Domain=example.com`** | **`SID=abc ;Secure;SameSite=Lax;Path=/p;Domain=example.com;Max-Age=60`** | **`SID=a b ;Domain=example.com ☢️`** | **`SID=v ;Domain=example.com`** | **`SID= ;Domain=example.com`** | **`SID=a\0b ;Domain=example.com ☢️`** | **`SID=a\x01b ;Domain=example.com ☢️`** | **`SID=ab ;Domain=example.com ☢️`** | **`SID=café ;Domain=example.com ☢️`** | `❌` | `❌` | **`naïve=v ;Domain=example.com ☢️`** | **`S ID=abc ;Domain=example.com ☢️`** | **`SID=a\x7fb ;Domain=example.com ☢️`** | **`SID=abc ;Domain=example.com`** | **`SID=abc ;Path=/a\0b;Domain=example.com`** | **`token[]=nested ;Domain=example.com ☢️`** | **`data={testdata:JSON} ;Domain=example.com ☢️`** | **`data=[nested] ;Domain=example.com`** | **`data=<img src=x /> ;Domain=example.com`** | **`"sid=surrounded-b…<34 chars> ;Domain=example.com ☢️`** |
| c/libcurl | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`SID=abc ;Secure;Domain=.example.com`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `❌` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `❌` | `❌` | `❌` | `❌` | `❌` | **`❌`** | `❌` | `❌` | `❌` | `❌` | `❌` | **`❌`** | **`❌`** | `❌` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `❌` | **`❌`** | **`❌`** | `❌` | `❌` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `❌` | **`❌`** | **`❌`** | **`SID=abc ;Domain=.com`** | **`SID=abc ;Domain=.co.uk`** | **`SID=abc ;Domain=.example.co.uk`** | **`SID=abc ;Domain=.xn--mnchen-3ya.de`** | **`SID=abc ;Domain=.münchen.de`** | **`SID=abc ;Domain=.ð\x9f\x8dª.eu`** | **`SID=abc ;Domain=.xn--hj8h.eu`** | **`SID=abc ;Domain=.xn--`** | **`SID=abc ;Domain=.ex_ample.com`** | **`SID=abc ;Domain=.b.example.com`** | **`SID=abc ;Domain=.café ☢️`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`SID=abc ;HttpOnly;Secure;Path=/p;Domain=.example.com`** | **`❌`** | **`❌`** | **`❌`** | `❌` | `❌` | **`❌`** | **`❌`** | `❌` | `❌` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** |
| client/curl | **`SID=abc`** | **`SID=abc`** | **`❌`** | **`SID=abc`** | **`SID=abc`** | `SID=abc ;Path=/b` | **`SID=abc ;Secure`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc ;Secure`** | **`__Secure-SID=abc ;Secure`** | **`❌`** | `__Host-SID=abc ;Secure;Path=/` | **`❌`** | **`❌`** | **`❌`** | **`__host-SID=abc`** | `__host-SID=abc ;Secure;Path=/` | **`SID=abc ;Secure`** | `__Host-SID=abc ;Secure;Path=/` | `❌` | **`SID=abc ;Secure`** | **`SID=abc ;Secure`** | **`SID=abc ;Secure`** | **`Partitioned=false`** | **`SID=abc%3B%20Partitioned ;Secure ☢️`** | **`SID="abc ;Secure ☢️`** | `❌` | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc ;Secure`** | **`SID=abc`** | **`SID=abc`** | `❌` | `❌` | `❌` | `❌` | `❌` | **`SID=abc`** | `❌` | `❌` | `❌` | `❌` | `❌` | **`SID=abc`** | **`❌`** | **`SID=abc`** | **`SID=abc`** | **`❌`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`❌`** | `❌` | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | `❌` | **`❌`** | **`SID=abc`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `❌` | `❌` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `❌` | `SID=abc ;Path=file:///etc/passwd` | `SID=abc` | `SID=abc ;Path=.` | `SID=abc ;Path=/aaa...aaa` | `❌` | **`SID=a ☢️`** | **`SID=v`** | **`SID=`** | `❌` | `❌` | **`SID=a"b ☢️`** | **`SID=café ☢️`** | `❌` | **`=v ☢️`** | **`naïve=v ☢️`** | **`S ID=abc ☢️`** | **`❌`** | **`❌`** | **`❌`** | **`token[]=nested ☢️`** | **`data={"testdata":"JSON"} ☢️`** | **`data=[nested]`** | **`data="<img src=x />" ☢️`** | **`"sid=surrounded-b…<26 chars> ;Secure ☢️`** |
| client/wget | **`SID=abc`** | **`SID=abc`** | **`❌`** | **`SID=abc`** | **`SID=abc ;Secure`** | **`❌`** | **`SID=abc ;Secure`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc ;Secure`** | **`__Secure-SID=abc ;Secure`** | **`__Secure-SID=abc`** | `__Host-SID=abc ;Secure;Path=/` | `__Host-SID=abc ;Path=/` | **`❌`** | **`❌`** | **`__host-SID=abc`** | `__host-SID=abc ;Secure;Path=/` | **`SID=abc ;Secure`** | `__Host-SID=abc ;Secure;Path=/` | `❌` | **`SID=abc ;Secure`** | **`SID=abc ;Secure`** | **`SID=abc ;Secure`** | **`Partitioned=false`** | **`SID=abc%3B%20Partitioned ;Secure ☢️`** | **`SID="abc; Partitioned" ;Secure ☢️`** | `❌` | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc ;Secure`** | **`SID=abc`** | **`SID=abc`** | `❌` | `❌` | `❌` | **`SID=abc`** | `❌` | **`SID=abc`** | `❌` | **`SID=abc`** | `❌` | `❌` | **`SID=abc`** | **`SID=abc`** | **`❌`** | `❌` | **`SID=abc`** | **`❌`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`❌`** | **`❌`** | `❌` | **`SID=abc`** | **`❌`** | `❌` | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`SID=abc`** | **`❌`** | `❌` | **`❌`** | **`SID=abc`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `❌` | `❌` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `❌` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `❌` | **`SID=a ☢️`** | **`SID=v`** | **`SID=`** | **`SID=a ☢️`** | **`SID=a\x01b ☢️`** | **`SID=a"b ☢️`** | **`SID=café ☢️`** | `❌` | `❌` | **`naïve=v ☢️`** | **`❌`** | **`SID=a\x7fb ☢️`** | **`SID=abc`** | **`❌`** | **`token[]=nested ☢️`** | **`data={"testdata":"JSON"} ☢️`** | **`data=[nested]`** | **`data="<img src=x />" ☢️`** | **`"sid=surrounded-b…<26 chars> ;Secure ☢️`** |
| browser/chromium | `SID=abc` | `SID=abc` | `SID=abc` | **`SID=abc ;SameSite=Lax ☢️`** | `SID=abc ;Secure` | `SID=abc ;Path=/b` | `SID=abc ;Secure` | **`❌`** | **`❌`** | `SID=abc ;Secure` | `__Secure-SID=abc ;Secure` | **`❌`** | `__Host-SID=abc ;Secure;Path=/` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `__host-SID=abc ;Secure;Path=/` | `SID=abc ;Secure;SameSite=None` | `__Host-SID=abc ;Secure;Path=/` | `❌` | `SID=abc ;Secure` | `SID=abc ;Secure` | `SID=abc ;Secure` | `Partitioned=false` | `SID=abc%3B%20Partitioned ;Secure ☢️` | `SID="abc ;Secure ☢️` | **`=Partitioned ☢️`** | `SID=abc ;SameSite=Strict` | `SID=abc ;SameSite=Lax` | **`❌`** | `SID=abc ;Secure;SameSite=None` | `SID=abc ;SameSite=Lax` | **`SID=abc ;SameSite=Lax ☢️`** | `❌` | `❌` | `❌` | `❌` | `❌` | **`❌`** | `❌` | `❌` | `❌` | `❌` | `❌` | `SID=abc` | `SID=abc` | `❌` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | **`❌`** | `❌` | `SID=abc` | **`❌`** | `❌` | `❌` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `❌` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `❌` | `❌` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `❌` | **`SID=abc ;Path⇒default`** | **`SID=abc ;Path⇒default`** | **`SID=abc ;Path⇒default`** | **`SID=abc ;Path⇒default`** | `❌` | **`SID=a ☢️`** | `SID=v` | `SID=` | `❌` | `❌` | `SID=a"b ☢️` | **`SID=café ☢️`** | **`=justvalue ☢️`** | **`=v ☢️`** | **`naïve=v ☢️`** | `S ID=abc ☢️` | **`❌`** | **`❌`** | **`❌`** | `token[]=nested ☢️` | `data={"testdata":"JSON"} ☢️` | `data=[nested]` | `data="<img src=x />" ☢️` | `"sid=surrounded-b…<26 chars> ;Secure ☢️` |
| browser/firefox | `SID=abc` | `SID=abc` | `SID=abc` | **`SID=abc ;SameSite=None ☢️`** | `SID=abc ;Secure` | `SID=abc ;Path=/b` | `SID=abc ;Secure` | **`❌`** | **`❌`** | `SID=abc ;Secure` | `__Secure-SID=abc ;Secure` | **`❌`** | `__Host-SID=abc ;Secure;Path=/` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `__host-SID=abc ;Secure;Path=/` | `SID=abc ;Secure;SameSite=None` | `__Host-SID=abc ;Secure;Path=/` | `❌` | `SID=abc ;Secure` | `SID=abc ;Secure` | `SID=abc ;Secure` | `Partitioned=false` | `SID=abc%3B%20Partitioned ;Secure ☢️` | `SID="abc ;Secure ☢️` | **`Partitioned= ☢️`** | `SID=abc ;SameSite=Strict` | `SID=abc ;SameSite=Lax` | **`❌`** | `SID=abc ;Secure;SameSite=None` | `SID=abc ;SameSite=Lax` | **`SID=abc ;SameSite=None ☢️`** | `❌` | `❌` | `❌` | `❌` | `❌` | **`❌`** | `❌` | `❌` | `❌` | `❌` | `❌` | `SID=abc` | **`❌`** | `❌` | **`❌`** | **`❌`** | `SID=abc` | **`❌`** | `SID=abc` | `SID=abc` | `SID=abc` | **`❌`** | `❌` | **`❌`** | **`❌`** | `❌` | `❌` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `❌` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `❌` | `❌` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `❌` | **`SID=abc ;Path⇒default`** | **`SID=abc ;Path⇒default`** | **`SID=abc ;Path⇒default`** | **`SID=abc ;Path⇒default`** | `❌` | **`SID=a ☢️`** | `SID=v` | `SID=` | `❌` | `❌` | `SID=a"b ☢️` | **`SID=café ☢️`** | **`justvalue= ☢️`** | `❌` | `naïve=v ☢️` | `S ID=abc ☢️` | **`❌`** | **`❌`** | **`❌`** | `token[]=nested ☢️` | `data={"testdata":"JSON"} ☢️` | `data=[nested]` | `data="<img src=x />" ☢️` | `"sid=surrounded-b…<26 chars> ;Secure ☢️` |
| browser/edge | `SID=abc` | `SID=abc` | `SID=abc` | **`SID=abc ;SameSite=Lax ☢️`** | `SID=abc ;Secure` | `SID=abc ;Path=/b` | `SID=abc ;Secure` | **`❌`** | **`❌`** | `SID=abc ;Secure` | `__Secure-SID=abc ;Secure` | **`❌`** | `__Host-SID=abc ;Secure;Path=/` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `__host-SID=abc ;Secure;Path=/` | `SID=abc ;Secure;SameSite=None` | `__Host-SID=abc ;Secure;Path=/` | `❌` | `SID=abc ;Secure` | `SID=abc ;Secure` | `SID=abc ;Secure` | `Partitioned=false` | `SID=abc%3B%20Partitioned ;Secure ☢️` | `SID="abc ;Secure ☢️` | **`=Partitioned ☢️`** | `SID=abc ;SameSite=Strict` | `SID=abc ;SameSite=Lax` | **`❌`** | `SID=abc ;Secure;SameSite=None` | `SID=abc ;SameSite=Lax` | **`SID=abc ;SameSite=Lax ☢️`** | `❌` | `❌` | `❌` | `❌` | `❌` | **`❌`** | `❌` | `❌` | `❌` | `❌` | `❌` | `SID=abc` | `SID=abc` | `❌` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | **`❌`** | `❌` | `SID=abc` | **`❌`** | `❌` | `❌` | `SID=abc` | `SID=abc` | `SID=abc` | `SID=abc` | `❌` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `❌` | `❌` | **`❌`** | **`❌`** | **`❌`** | **`❌`** | `❌` | **`SID=abc ;Path⇒default`** | **`SID=abc ;Path⇒default`** | **`SID=abc ;Path⇒default`** | **`SID=abc ;Path⇒default`** | `❌` | **`SID=a ☢️`** | `SID=v` | `SID=` | `❌` | `❌` | `SID=a"b ☢️` | **`SID=café ☢️`** | **`=justvalue ☢️`** | **`=v ☢️`** | **`naïve=v ☢️`** | `S ID=abc ☢️` | **`❌`** | **`❌`** | **`❌`** | `token[]=nested ☢️` | `data={"testdata":"JSON"} ☢️` | `data=[nested]` | `data="<img src=x />" ☢️` | `"sid=surrounded-b…<26 chars> ;Secure ☢️` |

## Jar probes — domain & path matching (§5.1.3 / §5.1.4)

Domain- and path-matching are two-input relations, so they cannot ride a single wire: each probe stores one `Set-Cookie` as if received from `origin`, then asks which cookies the jar would attach to a request to `request`.
`[SID=abc]` = the cookie is sent; `∅` = it is not — whether the jar refused storage or the match failed (one observable, so the consensus vote works unchanged).
`rust/rfc_6265 (reference)` executes the RFC 6265 §5.3/§5.4 algorithm built directly from that crate's primitives (`domain_matches`, `path_matches`, `default_path`).
In the default build it is the *bare* RFC algorithm — which attaches even a `Domain=com` supercookie, because rejecting a public suffix is the **optional** §5.3 step 5; the `hardened` build applies that policy, like the PSL-aware jars.
Codec-only parsers have no jar and drop out of this table.
Expiry, eviction, HttpOnly, and SameSite are out of scope here — they are API or time axes, not matching.

| jar | `jar-host-only-exact` | `jar-host-only-subdomain` | `jar-domain-exact` | `jar-domain-parent` | `jar-domain-superset` | `jar-domain-label-boundary` | `jar-domain-case` | `jar-domain-leading-dot` | `jar-domain-ip` | `jar-domain-supercookie` | `jar-path-prefix-boundary` | `jar-path-non-boundary` | `jar-path-trailing-slash` | `jar-path-default-sibling` | `jar-path-default-outside` | `jar-path-not-absolute` | `jar-secure-on-http` |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| **Set-Cookie** | `SID=abc` | `SID=abc` | `SID=abc; Domain=example.com` | `SID=abc; Domain=example.com` | `SID=abc; Domain=sub.example.com` | `SID=abc; Domain=example.com` | `SID=abc; Domain=EXAMPLE.COM` | `SID=abc; Domain=.example.com` | `SID=abc; Domain=127.0.0.1` | `SID=abc; Domain=com` | `SID=abc; Path=/a` | `SID=abc; Path=/a` | `SID=abc; Path=/a/` | `SID=abc` | `SID=abc` | `SID=abc; Path=name` | `SID=abc; Secure` |
| **origin** | `https://example.com/` | `https://example.com/` | `https://example.com/` | `https://sub.example.com/` | `https://example.com/` | `https://badexample.com/` | `https://example.com/` | `https://sub.example.com/` | `http://127.0.0.1/` | `https://example.com/` | `https://example.com/` | `https://example.com/` | `https://example.com/` | `https://example.com/dir/page` | `https://example.com/dir/page` | `https://example.com/dir/page` | `https://example.com/` |
| **request** | `https://example.com/` | `https://sub.example.com/` | `https://example.com/` | `https://other.example.com/` | `https://sub.example.com/` | `https://example.com/` | `https://example.com/` | `https://example.com/` | `http://127.0.0.1/` | `https://not-example.com/` | `https://example.com/a/b` | `https://example.com/ab` | `https://example.com/a` | `https://example.com/dir/other` | `https://example.com/elsewhere` | `https://example.com/dir/other` | `http://example.com/` |
| **RFC (standard)** | host-only: the same host attaches (§5.4) | host-only never flows to subdomains (§5.4) | a Domain cookie flows to matching hosts (§5.1.3) | a Domain cookie flows to matching hosts (§5.1.3) | the origin must domain-match Domain (§5.3 step 6) | a suffix counts only at a label boundary (§5.1.3) | Domain is canonicalized lower-case (§5.1.2) | a leading dot is stripped (§5.2.3) | an IP host matches only by identity (§5.1.3) | rejecting a public-suffix Domain is *optional* (§5.3 step 5) | a path prefix matches at a `/` boundary (§5.1.4) | a prefix without a boundary never matches (§5.1.4) | `/a/` does not match its parent `/a` (§5.1.4) | no Path → the origin's default-path (§5.3 step 7) | no Path → the origin's default-path (§5.3 step 7) | a non-`/` Path is ignored → default-path (§5.2.4) | Secure needs a secure channel (§5.4) |
| **consensus** | `[SID=abc]` | `∅` | `[SID=abc]` | `[SID=abc]` | `∅` | `∅` | `[SID=abc]` | `[SID=abc]` | `[SID=abc]` | `∅` | `[SID=abc]` | `∅` | `∅` | `[SID=abc]` | `∅` | `[SID=abc]` | `∅` |
| rust/cookie_store | `[SID=abc]` | `∅` | `[SID=abc]` | `[SID=abc]` | `∅` | `∅` | `[SID=abc]` | `[SID=abc]` | `[SID=abc]` | **`[SID=abc]`** | `[SID=abc]` | `∅` | `∅` | `[SID=abc]` | `∅` | `[SID=abc]` | `∅` |
| rust/rfc_6265 (reference) | `[SID=abc]` | `∅` | `[SID=abc]` | `[SID=abc]` | `∅` | `∅` | `[SID=abc]` | `[SID=abc]` | `[SID=abc]` | **`[SID=abc]`** | `[SID=abc]` | `∅` | `∅` | `[SID=abc]` | `∅` | `[SID=abc]` | `∅` |
| rust/kekse (store) | `[SID=abc]` | `∅` | `[SID=abc]` | `[SID=abc]` | `∅` | `∅` | `[SID=abc]` | `[SID=abc]` | `[SID=abc]` | **`[SID=abc]`** | `[SID=abc]` | `∅` | `∅` | `[SID=abc]` | `∅` | `[SID=abc]` | `∅` |
| python/http.cookiejar | `[SID=abc]` | **`[SID=abc]`** | `[SID=abc]` | `[SID=abc]` | `∅` | `∅` | `[SID=abc]` | `[SID=abc]` | `[SID=abc]` | `∅` | `[SID=abc]` | `∅` | `∅` | `[SID=abc]` | `∅` | **`∅`** | `∅` |
| node/tough-cookie | `[SID=abc]` | `∅` | `[SID=abc]` | `[SID=abc]` | `∅` | `∅` | `[SID=abc]` | `[SID=abc]` | **`∅`** | `∅` | `[SID=abc]` | `∅` | `∅` | `[SID=abc]` | `∅` | `[SID=abc]` | `∅` |
| browser/chromium | `[SID=abc]` | `∅` | `[SID=abc]` | `[SID=abc]` | `∅` | `∅` | `[SID=abc]` | `[SID=abc]` | `[SID=abc]` | `∅` | `[SID=abc]` | `∅` | `∅` | `[SID=abc]` | `∅` | `[SID=abc]` | **`[SID=abc]`** |
| browser/firefox | `[SID=abc]` | `∅` | `[SID=abc]` | `[SID=abc]` | `∅` | `∅` | `[SID=abc]` | `[SID=abc]` | `[SID=abc]` | `∅` | `[SID=abc]` | `∅` | `∅` | `[SID=abc]` | `∅` | `[SID=abc]` | `∅` |
| browser/edge | `[SID=abc]` | `∅` | `[SID=abc]` | `[SID=abc]` | `∅` | `∅` | `[SID=abc]` | `[SID=abc]` | `[SID=abc]` | `∅` | `[SID=abc]` | `∅` | `∅` | `[SID=abc]` | `∅` | `[SID=abc]` | `∅` |

## Attribute fidelity

`resp-all-attrs` sets all seven non-date attributes; this is which each parser surfaces.
`◌` marks an attribute the driver's reporting channel cannot observe (classic WebDriver and the Netscape jar format carry no `Partitioned` field) — not a drop.
`✗` = dropped — except the client jars' `Max-Age`, which they fold into an absolute expiry rather than report as such.
The eighth attribute, `Expires`, is shown per parser in the `date-*` columns of the Set-Cookie table above rather than here.
Parsers that rejected the cookie outright are omitted.

| parser | HttpOnly | Secure | SameSite | Path | Domain | Max-Age | Partitioned |
| --- | --- | --- | --- | --- | --- | --- | --- |
| rust/kekse (lenient) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| rust/kekse (strict) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| rust/kekse (fail-hard) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| rust/cookie | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ |
| rust/cookie_store | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ |
| python/http.cookiejar | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ |
| python/mitmproxy | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| node/tough-cookie | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| node/set-cookie-parser | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| go/net/http | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| dotnet/Microsoft.Net.Http.Headers | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ◌ |
| java/Jakarta RESTEasy | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ◌ |
| java/Jakarta Jersey | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ◌ |
| java/java.net.HttpCookie | ✓ | ✓ | ✗ | ✓ | ✓ | ✓ | ◌ |
| java/Apache HttpClient5 | ✗ | ✓ | ✓ | ✓ | ✓ | ✓ | ◌ |
| c/libcurl | ✓ | ✓ | ✗ | ✓ | ✓ | ✗ | ◌ |

## Calibration

kekse's two dials graded against the answering parse columns, per response row: a wire strict parses **clean** must be majority-accepted (law A — strict-clean means universally sendable), and a majority-accepted wire must be lenient-accepted (law B — lenient is calibrated to reality) unless it is a listed deliberate deviation with its reason.
Store-backed columns (client jars, browsers, `cookie_store`) report storage policy, not parse verdicts, so they do not vote; subjects never vote.
A violation of either law fails the matrix run.

Both laws hold over this run's answering columns (12 deliberate lenient deviation(s) listed below).

| scenario | verdict | accepting | rejecting | reason |
| --- | --- | --- | --- | --- |
| resp-quoted-attr-text | deliberate deviation | 11 (rust/cookie, python/SimpleCookie, python/http.cookiejar, python/mitmproxy, node/tough-cookie, node/set-cookie-parser, dotnet/Microsoft.Net.Http.Headers, java/Jakarta RESTEasy, java/Jakarta Jersey, java/java.net.HttpCookie, java/Apache HttpClient5) | 2 (go/net/http, c/libcurl) | §5.2 splits before any unquoting, leaving a bare `"abc` value the octet rule refuses; quote-spanning parsers swallow the attribute into the value instead (with the raw `;` re-emission hazard that carries) |
| resp-crlf | deliberate deviation | 9 (rust/cookie, python/http.cookiejar, python/mitmproxy, node/tough-cookie, node/set-cookie-parser, java/Jakarta RESTEasy, java/Jakarta Jersey, java/java.net.HttpCookie, java/Apache HttpClient5) | 4 (python/SimpleCookie, go/net/http, dotnet/Microsoft.Net.Http.Headers, c/libcurl) | a raw CR/LF, NUL, or other control byte in a value is the header-injection / log-poison vector kekse refuses in every mode — the permissive majority keeps it, and re-emission then splits or poisons the carrying header |
| resp-ctl-nul | deliberate deviation | 9 (rust/cookie, python/http.cookiejar, python/mitmproxy, node/tough-cookie, node/set-cookie-parser, java/Jakarta RESTEasy, java/Jakarta Jersey, java/java.net.HttpCookie, java/Apache HttpClient5) | 4 (python/SimpleCookie, go/net/http, dotnet/Microsoft.Net.Http.Headers, c/libcurl) | a raw CR/LF, NUL, or other control byte in a value is the header-injection / log-poison vector kekse refuses in every mode — the permissive majority keeps it, and re-emission then splits or poisons the carrying header |
| resp-ctl-other | deliberate deviation | 8 (rust/cookie, python/http.cookiejar, python/mitmproxy, node/set-cookie-parser, java/Jakarta RESTEasy, java/Jakarta Jersey, java/java.net.HttpCookie, java/Apache HttpClient5) | 5 (python/SimpleCookie, node/tough-cookie, go/net/http, dotnet/Microsoft.Net.Http.Headers, c/libcurl) | a raw CR/LF, NUL, or other control byte in a value is the header-injection / log-poison vector kekse refuses in every mode — the permissive majority keeps it, and re-emission then splits or poisons the carrying header |
| resp-quote-interior | deliberate deviation | 9 (rust/cookie, python/http.cookiejar, python/mitmproxy, node/tough-cookie, node/set-cookie-parser, java/Jakarta RESTEasy, java/Jakarta Jersey, java/java.net.HttpCookie, java/Apache HttpClient5) | 4 (python/SimpleCookie, go/net/http, dotnet/Microsoft.Net.Http.Headers, c/libcurl) | a bare DQUOTE is outside the cookie-octet alphabet in both gradings; quote-tolerant parsers keep it and diverge on where the value ends |
| resp-non-ascii | deliberate deviation | 9 (rust/cookie, python/http.cookiejar, python/mitmproxy, node/tough-cookie, node/set-cookie-parser, java/Jakarta RESTEasy, java/Jakarta Jersey, java/java.net.HttpCookie, java/Apache HttpClient5) | 4 (python/SimpleCookie, go/net/http, dotnet/Microsoft.Net.Http.Headers, c/libcurl) | a raw non-ASCII byte is outside the cookie-octet alphabet; percent-encoding is the lossless carrier kekse insists on |
| resp-non-ascii-name | deliberate deviation | 8 (rust/cookie, python/http.cookiejar, python/mitmproxy, node/tough-cookie, node/set-cookie-parser, java/Jakarta RESTEasy, java/Jakarta Jersey, java/Apache HttpClient5) | 5 (python/SimpleCookie, go/net/http, dotnet/Microsoft.Net.Http.Headers, java/java.net.HttpCookie, c/libcurl) | kekse requires an RFC 7230 token as the cookie-name (deliberately stricter than §5.2's anything-before-`=`): a non-token name has no wire form kekse's own writer could emit, so the pair is refused as unusable |
| resp-space-in-name | deliberate deviation | 8 (rust/cookie, python/http.cookiejar, python/mitmproxy, node/tough-cookie, node/set-cookie-parser, java/Jakarta RESTEasy, java/Jakarta Jersey, java/Apache HttpClient5) | 5 (python/SimpleCookie, go/net/http, dotnet/Microsoft.Net.Http.Headers, java/java.net.HttpCookie, c/libcurl) | kekse requires an RFC 7230 token as the cookie-name (deliberately stricter than §5.2's anything-before-`=`): a non-token name has no wire form kekse's own writer could emit, so the pair is refused as unusable |
| resp-del-byte | deliberate deviation | 9 (rust/cookie, python/http.cookiejar, python/mitmproxy, node/tough-cookie, node/set-cookie-parser, java/Jakarta RESTEasy, java/Jakarta Jersey, java/java.net.HttpCookie, java/Apache HttpClient5) | 4 (python/SimpleCookie, go/net/http, dotnet/Microsoft.Net.Http.Headers, c/libcurl) | a raw CR/LF, NUL, or other control byte in a value is the header-injection / log-poison vector kekse refuses in every mode — the permissive majority keeps it, and re-emission then splits or poisons the carrying header |
| resp-array-name | deliberate deviation | 9 (rust/cookie, python/http.cookiejar, python/mitmproxy, node/tough-cookie, node/set-cookie-parser, java/Jakarta RESTEasy, java/Jakarta Jersey, java/java.net.HttpCookie, java/Apache HttpClient5) | 4 (python/SimpleCookie, go/net/http, dotnet/Microsoft.Net.Http.Headers, c/libcurl) | kekse requires an RFC 7230 token as the cookie-name (deliberately stricter than §5.2's anything-before-`=`): a non-token name has no wire form kekse's own writer could emit, so the pair is refused as unusable |
| resp-json-value | deliberate deviation | 9 (rust/cookie, python/http.cookiejar, python/mitmproxy, node/tough-cookie, node/set-cookie-parser, java/Jakarta RESTEasy, java/Jakarta Jersey, java/java.net.HttpCookie, java/Apache HttpClient5) | 4 (python/SimpleCookie, go/net/http, dotnet/Microsoft.Net.Http.Headers, c/libcurl) | a bare DQUOTE is outside the cookie-octet alphabet in both gradings; quote-tolerant parsers keep it and diverge on where the value ends |
| resp-quoted-pair-flag | deliberate deviation | 9 (rust/cookie, python/http.cookiejar, python/mitmproxy, node/tough-cookie, node/set-cookie-parser, java/Jakarta RESTEasy, java/Jakarta Jersey, java/java.net.HttpCookie, java/Apache HttpClient5) | 4 (python/SimpleCookie, go/net/http, dotnet/Microsoft.Net.Http.Headers, c/libcurl) | kekse requires an RFC 7230 token as the cookie-name (deliberately stricter than §5.2's anything-before-`=`): a non-token name has no wire form kekse's own writer could emit, so the pair is refused as unusable |

## Tested scenarios

One line per test — the id each matrix column is headed by, and what its wire probes.
Outcomes are not repeated here; read them from the tables above (a **bold** cell diverges from the consensus).

### Request `Cookie:` scenarios

- **`ws-surrounding`** — SP/HTAB around name and value are trimmed away.
- **`ws-internal`** — an internal space: lenient keeps it, strict refuses the non-octet.
- **`ctl-nul`** — a NUL in the value drops that pair, never the later one.
- **`ctl-crlf`** — a CR/LF in the value is refused (the header-injection probe).
- **`ctl-other`** — a C0 control byte in the value drops that pair.
- **`quote-unbalanced`** — a dangling quote is a non-octet, so the pair is dropped.
- **`quote-interior`** — an interior quote is a non-octet, so the pair is dropped.
- **`pct-truncated`** — a stray % passes through verbatim.
- **`pct-bad-utf8`** — an escape that decodes to invalid UTF-8 drops the pair.
- **`raw-non-utf8`** — a raw non-UTF-8 byte cannot be a &str at all.
- **`delim-semicolon`** — a raw ; splits the header — it cannot be smuggled into a value.
- **`delim-empty-segments`** — empty ;-segments are skipped.
- **`no-equals`** — a segment with no = is skipped.
- **`extra-equals`** — split is on the first = only; the rest is the value.
- **`dup-name`** — duplicate names are all kept, in order.
- **`dup-case`** — names are case-sensitive: sid and SID are distinct cookies.
- **`empty-name`** — an empty name drops that pair.
- **`empty-value`** — an empty value is a valid, empty cookie.
- **`raw-non-ascii`** — a raw non-ASCII value is refused (not a cookie-octet).
- **`non-ascii-name`** — a non-token name is refused.
- **`scale-huge-value`** — a 4 KiB value survives as one pair.
- **`scale-many-pairs`** — 20 pairs plus a sentinel all parse.
- **`scale-control-junk`** — a long control-junk segment is dropped, its neighbours kept.
- **`req-partitioned-name`** — a request pair named Partitioned: Cookie: headers carry no attributes, so it is a plain pair in both gradings.
- **`nul-in-name`** — a NUL in the cookie name makes it a non-token — that pair is dropped.
- **`nul-between-cookies`** — a NUL fused to a later pair's name drops only it; neighbours survive.
- **`tab-around`** — HTAB around name and value is trimmed just like SP — tab is accepted.
- **`raw-emoji`** — a raw 4-byte emoji value is refused (not cookie-octets), like any non-ASCII.
- **`pct-emoji`** — a percent-encoded emoji round-trips to the 4-byte codepoint.
- **`array-name`** — a bracketed array-name: kekse drops the non-token; PHP builds an array.
- **`assoc-name`** — a bracketed map-name: kekse drops the non-token; PHP builds a map.
- **`json-value`** — a JSON object as a value: the interior DQUOTE is a non-octet, so it drops.
- **`bracket-value`** — brackets in the value are cookie-octets: kept verbatim (cf. array-name).
- **`markup-no-equals`** — a bare <script> token has no =, so that segment is skipped.
- **`markup-name`** — angle brackets are not token chars, so the <script> name drops.
- **`quoted-html-value`** — a quoted markup value: quotes strip, then the interior space splits lenient from strict.
- **`truthy`** — a clean truthy value stays the string "yes" — no parser coerces a bool.
- **`equals-bare`** — a bare = is an empty name: the pair is dropped.
- **`equals-double`** — == splits to an empty name with value `=`: the pair is dropped.
- **`nul-empty-name`** — a name that is a lone NUL byte is a non-token: that pair is dropped.

### Response `Set-Cookie:` scenarios

- **`attr-unknown`** — an unknown attribute is recovered and witnessed in both gradings.
- **`attr-unknown-bare`** — a BARE unknown flag: kekse witnesses it like the valued form, but python's SimpleCookie loses the whole cookie on exactly this shape.
- **`attr-bad-maxage`** — a non-numeric Max-Age is dropped; the cookie is kept.
- **`attr-garbage-samesite`** — a garbage SameSite token is dropped; the cookie is kept.
- **`attr-valued-flag`** — Secure=1 sets the flag; the bogus value is ignored.
- **`attr-duplicate`** — a duplicated known attribute keeps last-wins, witnessed in both gradings.
- **`resp-partitioned-secure`** — Partitioned with its required Secure pairing parses clean.
- **`resp-partitioned-bare`** — Partitioned without Secure violates CHIPS — witnessed, the flag kept.
- **`resp-partitioned-valued`** — Partitioned=1 sets the flag; the bogus value and the missing Secure are witnessed.
- **`resp-partitioned-dup`** — a duplicated Partitioned keeps the flag once and witnesses the repeat.
- **`prefix-secure-ok`** — __Secure- with the Secure attribute is conformant — a clean parse.
- **`prefix-secure-missing`** — __Secure- without the Secure attribute — witnessed, cookie kept.
- **`prefix-host-ok`** — __Host- with Secure and Path=/ (and no Domain) is conformant — a clean parse.
- **`prefix-host-missing-secure`** — __Host- without the Secure attribute — witnessed, cookie kept.
- **`prefix-host-domain`** — __Host- must not carry a Domain — the attribute is kept and the violation witnessed.
- **`prefix-host-path`** — __Host- requires Path=/ exactly — the nonconformant path is kept and witnessed.
- **`prefix-host-case`** — a case-variant __host- still triggers the prefix rules, as user agents match them.
- **`prefix-host-case-conformant`** — a case-variant __host- meeting every requirement is witnessed for the casing alone — curl-class agents match prefixes case-sensitively and lose the protection here.
- **`resp-partitioned-samesite-none`** — the embedded-widget shape (SameSite=None; Secure; Partitioned) — engines apply the None-requires-Secure and CHIPS policies together.
- **`prefix-host-partitioned`** — CHIPS' recommended pairing: a __Host--prefixed, secure, partitioned cookie is fully conformant.
- **`resp-partitioned-domain`** — Domain alongside Partitioned: current CHIPS allows it, early engine policy required host-only — a version split for the matrix to show.
- **`resp-partitioned-false`** — Partitioned=false still sets the presence-only flag; a value-interpreting parser would clear it instead.
- **`resp-partitioned-true`** — Partitioned=true sets the flag like the bare form, with the discarded value witnessed.
- **`resp-partitioned-case`** — attribute names match case-insensitively (RFC 6265 §5.2), so pArTiTiOnEd is the flag.
- **`resp-partitioned-name`** — a cookie literally named Partitioned: the leading segment is the pair, never a flag.
- **`resp-encoded-semicolon-attr`** — an encoded `;` stays value: a decode-then-split parser would hallucinate a Partitioned attribute out of the cookie's own value.
- **`resp-quoted-attr-text`** — §5.2 splits before any unquoting, so the quotes cannot swallow the attribute: the leading value becomes a bare `"abc`, which kekse's octet rule refuses outright.
- **`resp-partitioned-leading`** — an attribute token in pair position: the leading segment has no `=`, so there is no usable pair — a parser that recognises attribute names anywhere may skip to SID.
- **`resp-samesite-strict`** — SameSite=Strict parses to the typed variant in both modes.
- **`resp-samesite-lax`** — SameSite=Lax parses to the typed variant in both modes.
- **`resp-samesite-none-bare`** — SameSite=None without Secure — kekse keeps the typed value (parse time has no storage policy); the matrix shows who refuses the pairing.
- **`resp-samesite-none-secure`** — SameSite=None; Secure — the 6265bis-conformant pairing.
- **`resp-samesite-case`** — the SameSite value is ASCII-case-insensitive: lAx parses as Lax.
- **`resp-samesite-empty`** — an empty SameSite= is dropped and the cookie kept — the row where jars reveal what they assume when the attribute says nothing.
- **`date-imf-fixdate`** — the canonical RFC 7231 IMF-fixdate parses in both modes.
- **`date-rfc850`** — the obsolete RFC 850 form parses leniently; strict refuses it.
- **`date-asctime`** — the asctime() form parses leniently; strict refuses it.
- **`date-no-weekday`** — a cookie-date without a weekday parses leniently; strict requires one.
- **`date-wrong-weekday`** — a weekday inconsistent with the date parses leniently (§5.1.1 ignores it); strict rejects it — 06 Nov 1994 was a Sunday, not a Monday.
- **`date-nonsense-weekday`** — a non-weekday token ("Birthday") where the weekday belongs parses leniently (ignored); strict rejects it as not a day-of-week name.
- **`date-no-timezone`** — a cookie-date without a zone parses leniently (§5.1.1 ignores it); strict requires GMT.
- **`date-reordered`** — §5.1.1 is order-independent, so a reordered cookie-date parses leniently; strict does not.
- **`date-2digit-year-imf-shape`** — an IMF-shaped date with a two-digit year pivots leniently; strict wants four digits.
- **`date-trailing-comment`** — trailing tokens after a complete cookie-date are ignored leniently; strict refuses them.
- **`date-unix`** — the Unix `date` form parses leniently — §5.1.1 ignores the stray zone token — but strict refuses it.
- **`date-garbage`** — an unparseable date is dropped in both modes; the cookie survives.
- **`date-impossible-day`** — a well-formed but impossible day (31 Feb) is rejected by both modes.
- **`date-year-pre-1601`** — §5.1.1 rejects a year before 1601 in both modes — the far-past footgun.
- **`date-minute-out-of-range`** — a minute past 59 is rejected by both modes.
- **`date-second-out-of-range`** — a second past 59 is rejected by both modes.
- **`date-iso8601`** — an ISO 8601 timestamp is not an RFC 6265 cookie-date.
- **`date-us-slash`** — a US M/D/Y numeric date is not a cookie-date.
- **`date-eu-dotted`** — a European D.M.Y numeric date is not a cookie-date.
- **`date-epoch`** — a bare Unix epoch-seconds integer is not a cookie-date.
- **`date-2digit-year-69`** — the two-digit-year pivot's upper edge: 69 → 2069 (§5.1.1 steps 3–4); strict wants four digits.
- **`date-2digit-year-70`** — the pivot's lower edge: 70 → 1970 — the parsed instant is exactly the Unix epoch.
- **`date-year-1601-boundary`** — the accept side of the §5.1.1 year floor: 1601 parses in both modes (1600 does not).
- **`date-hour-out-of-range`** — an hour past 23 is rejected by both modes (completes the minute/second family).
- **`date-1-digit-day`** — a one-digit day is 1*2DIGIT, so it parses leniently; strict requires two digits.
- **`date-month-case`** — an upper-cased month parses leniently (the month token is case-insensitive); strict wants canonical casing.
- **`date-month-overlong`** — a spelled-out month matches on its first three letters (§5.1.1); strict refuses it.
- **`date-year-trailing-alpha`** — a year with a non-digit tail (`1994AD`) parses leniently — year = 2*4DIGIT ( non-digit *OCTET ).
- **`date-5-digit-year`** — five leading digits match no year token (2*4DIGIT), so both modes drop the date.
- **`date-missing-year`** — a date missing its year is dropped by both modes; parsers that default a year diverge.
- **`date-empty`** — an empty Expires value carries no date; the attribute is dropped and the cookie survives.
- **`date-zone-offset`** — a numeric zone offset is ignored leniently (§5.1.1 reads no zone); offset-honouring parsers shift the instant.
- **`date-tab-delims`** — HTAB is a §5.1.1 delimiter, so a tab-separated date parses leniently; strict wants single spaces.
- **`date-first-token-wins`** — §5.1.1 binds each field to the FIRST matching token: the second time-shaped token becomes the day (8), the bare `06` the year (2006).
- **`domain-supercookie-tld`** — Domain=.com is a supercookie: stored verbatim by the pure codec, refused under `psl`.
- **`domain-supercookie-icann`** — Domain=co.uk is a multi-label public suffix: stored by the pure codec, refused under `psl`.
- **`domain-registrable`** — a real registrable Domain (eTLD+1) survives in every build.
- **`domain-punycode`** — a punycode A-label IDN (xn--mnchen-3ya.de = münchen.de) is valid in every build.
- **`domain-utf8`** — a raw UTF-8 (U-label) Domain is non-ASCII, so the av-octet rule drops it in every build.
- **`domain-emoji-utf8`** — a raw emoji-label Domain (🍪.eu) is non-ASCII U-label bytes — the av-octet rule drops it everywhere.
- **`domain-emoji-punycode`** — the A-label of 🍪.eu (xn--hj8h.eu) is av-octet-clean and valid per UTS-46, so it survives every build — the .eu registry would refuse the emoji, but the IDNA encoding itself is valid.
- **`domain-malformed-punycode`** — malformed punycode is av-octet-clean, so the pure codec stores it; the hardened build refuses it.
- **`domain-not-a-host-name`** — an underscored label is av-octet-clean but not LDH host-name syntax: the pure codec stores it verbatim, the hardened build refuses a Domain that could never domain-match.
- **`domain-dup-last-wins`** — two valid Domains: lenient takes the last, strict rejects the duplicate.
- **`domain-dup-valid-then-invalid`** — a valid then an invalid Domain: the earlier valid Domain survives (§5.2.2), duplicate witnessed.
- **`path-file-uri`** — a file:// URI as a Path is just av-octets to RFC 6265 — stored verbatim, no traversal meaning.
- **`path-empty`** — an empty Path= value is av-octet-clean (zero octets) and kept as an empty path.
- **`path-dot`** — a bare relative Path=. is stored verbatim (no default-path resolution at parse time; Path=./ behaves identically across every parser, so only the bare dot is kept here).
- **`path-overlong-1025`** — a 1025-byte Path value: RFC 6265 puts no length cap on an av (kekse keeps it verbatim); 6265bis caps attribute values at 1024 bytes, so engines drop the attribute and fall back to the request's default-path.
- **`resp-all-attrs`** — a cookie setting all seven non-date attributes (Secure, HttpOnly, SameSite, Path, Domain, Max-Age, Partitioned) — the attribute-fidelity probe.
- **`resp-crlf`** — a CR/LF in the Set-Cookie value is refused outright.
- **`resp-ws-surrounding`** — SP around the Set-Cookie name and value are trimmed away.
- **`resp-empty-value`** — an empty Set-Cookie value is a valid, empty cookie.
- **`resp-ctl-nul`** — a NUL in the Set-Cookie value is not a cookie-octet — the cookie is refused.
- **`resp-ctl-other`** — a C0 control byte in the Set-Cookie value is refused.
- **`resp-quote-interior`** — an interior DQUOTE is not a cookie-octet — the cookie is refused.
- **`resp-non-ascii`** — a raw non-ASCII Set-Cookie value is refused (not cookie-octets).
- **`resp-nameless-bare`** — a bare token with no `=` at all: RFC 6265 §5.2 ignores the whole set-cookie-string; 6265bis reads a nameless cookie.
- **`resp-nameless-eq`** — an empty name (`=v`) is refused by kekse; nameless-tolerant parsers keep a value-only cookie.
- **`resp-non-ascii-name`** — a non-token (non-ASCII) Set-Cookie name is refused by kekse.
- **`resp-space-in-name`** — a raw SP inside the Set-Cookie name — SP is not a token character.
- **`resp-del-byte`** — DEL (0x7F) in the Set-Cookie value is a CTL, not a cookie-octet.
- **`attr-nul-name`** — a NUL in an attribute name is an unknown attribute: recovered and witnessed.
- **`attr-nul-value`** — a NUL in a Path value fails the av-octet gate: the Path is dropped and witnessed.
- **`resp-array-name`** — a bracketed array-name in Set-Cookie: the non-token name is refused.
- **`resp-json-value`** — a JSON object Set-Cookie value: the interior DQUOTE is refused.
- **`resp-bracket-value`** — brackets in a Set-Cookie value are octets: a valid cookie.
- **`resp-quoted-html-value`** — a quoted markup Set-Cookie value: response always allows WS, so both modes keep it.
- **`resp-quoted-pair-flag`** — a whole quoted name=value plus a flag: the leading DQUOTE makes the name a non-token.

### Jar probe scenarios

- **`jar-host-only-exact`** — no Domain attribute → a host-only cookie; the identical host gets it back.
- **`jar-host-only-subdomain`** — a host-only cookie never flows to a subdomain — only a Domain cookie widens.
- **`jar-domain-exact`** — Domain equal to the origin host attaches on that host.
- **`jar-domain-parent`** — a parent Domain set from one subdomain attaches on a sibling subdomain.
- **`jar-domain-superset`** — a Domain *below* the origin host is refused at storage — the origin must domain-match it.
- **`jar-domain-label-boundary`** — badexample.com does not domain-match example.com — a suffix only counts at a label boundary.
- **`jar-domain-case`** — an upper-cased Domain is canonicalized (§5.1.2) before matching.
- **`jar-domain-leading-dot`** — a leading dot on Domain is stripped (§5.2.3); the cookie then flows like a dotless one.
- **`jar-domain-ip`** — an IP-literal host matches a Domain only by identity — never by suffix.
- **`jar-domain-supercookie`** — Domain=com is a public suffix: the bare RFC algorithm attaches it across registrable domains; the hardened build (and PSL-aware jars) refuse it at storage.
- **`jar-path-prefix-boundary`** — Path=/a matches /a/b — a prefix at a `/` boundary.
- **`jar-path-non-boundary`** — Path=/a does not match /ab — a prefix without a boundary never matches.
- **`jar-path-trailing-slash`** — Path=/a/ does not match its parent /a — the longer cookie-path is never a prefix.
- **`jar-path-default-sibling`** — no Path → the origin's default-path (/dir); a sibling under it gets the cookie.
- **`jar-path-default-outside`** — no Path → the origin's default-path (/dir); a request outside it does not.
- **`jar-path-not-absolute`** — a Path not starting with `/` is ignored (§5.2.4) — the default-path applies instead.
- **`jar-secure-on-http`** — a Secure cookie set over https is not attached to a plain-http request.

## Remarks

Date/expiry behaviour — what a *client* cares about — lives in the Set-Cookie section, where `Expires` is meaningful; the request side carries none.
A parsed `Expires` renders in the cell as `;Expires=<UTC date>`; a client jar that folds `Expires` and `Max-Age` into one effective (possibly now-relative) expiry reports none, so cells stay reproducible.

Request side: the `cookie` crate runs in percent-decoding (`*_encoded`) mode so its values are comparable to kekse's.
biscotti is fail-hard and exposes no general iterator, so its accepted pairs are enumerated by name.
PHP's `$_COOKIE` is parsed natively behind its built-in server (`php -S`), showing PHP's own quirks — value urldecoding, cookie-name mangling, and transport-layer rejection of CR/LF/NUL.
A bracketed name (`name[]`/`name[k]`) makes PHP build an array/map — the only non-string types here, shown by type name (`⟨array⟩`/`⟨object⟩`); every other parser keeps a bracketed name a flat string or drops it.
Go (`net/http`, since 1.23) and .NET (`Microsoft.Net.Http.Headers`) parse both directions; a toolchain absent from the run shows `SKIP` (the CI matrix job has them all).

nginx is exercised behind a real openresty server, replayed over a socket like PHP.
Its `$cookie_<name>` column is nginx's *native* by-name lookup; `lua-resty-cookie` is an OpenResty Lua library that parses the raw header.
`nginx/proxy` is a fidelity axis — did a `proxy_pass` forward the request Cookie verbatim (`≡`), alter it (`≠`), or refuse it (`❌`) — and `nginx/proxy (Set-Cookie)` asks the same of an upstream `Set-Cookie` forwarded back to a client (nginx exposes no *parsed* Set-Cookie to Lua, so it is fidelity, not a parse — it escapes a smuggled CR/LF to `%0D%0A` rather than dropping it).
Both are off the consensus vote.

The Java sidecar runs from a JVM image and adds six columns.
Two Tomcat request-cookie processors — `Tomcat RFC6265` (strict) and `Tomcat legacy` (lenient) — and the `jakarta.ws.rs` cookie API via two providers (RESTEasy + Jersey), which parse both directions.
For Set-Cookie it also runs the JDK's `java.net.HttpCookie` and `Apache HttpClient5`'s RFC 6265 spec — the realistic redistributable stand-in for the proprietary BurpSuite parser, which cannot be bundled or run headless.

Set-Cookie side: alongside the pure parsers (kekse, the `cookie` crate, tough-cookie, SimpleCookie, mitmproxy, Go, .NET, the Java columns) sit the real C HTTP clients.
`c/libcurl` drives libcurl's cookie engine offline in C — it cannot export a cookie injected without a `Domain`, so host-only cookies show `❌`; `client/curl` and `client/wget` fetch from a loopback server, the *transfer* view, where the request host supplies the domain (so host-only cookies parse, while a `Domain=` mismatching 127.0.0.1 is refused) — the two views are complementary.
The browser rows (`browser/chromium`, `browser/firefox`, `browser/edge`) are the *engine* transfer view: a real headless browser fetches the wire from a loopback **https** origin (`wire.keksbruch.example`) and its stored cookie is read back through WebDriver.
They run release defaults, so RFC 6265bis policy shows through — the 4096-byte name+value cap, control-byte rejection, the public-suffix list, and each engine's SameSite stance — and a `Domain=` naming a foreign host is refused at storage like the client columns, though the https origin lets `Secure` cookies store.
Every host also resolves to loopback (`127.0.0.1`), and a browser may treat a localhost/loopback origin as a potentially-trustworthy *secure context* even over plain http, relaxing the `Secure`-attribute channel rule — the likely reason Chromium attaches the cookie on `jar-secure-on-http`, where §5.4 and the client columns refuse it, so read that browser cell as an artifact of the loopback harness rather than a real-world verdict.
A browser cell reports an attribute only when the wire engaged it, because the jar holds *effective* state rather than attribute text: an unlabeled cookie shows no SameSite even though the engine enforces one, an engaged degenerate value reveals the engine's fallback (Chromium assumes `Lax`, Firefox `None` — Lax-by-default is unshipped there), and `Path⇒default` marks a `Path` the engine could not use, so the cookie took the request's default-path (§5.1.4) — the fall-back is stated, not the origin's own directory (`/r` here).
Edge shares Chromium's `net/cookies` unchanged; its column exists to demonstrate that equivalence cell by cell.
A parser that *crashes* on a payload — a panic, a signal, a hang — is marked `☠️` and pinned to that exact payload, distinct from a clean rejection (`❌`) or an unavailable tool (`SKIP`).

Reading a browser's date rows: a `Set-Cookie` with a *past* `Expires` is stored and then expired on arrival, so it reads back as a rejection (`❌`), whereas an *unparsable* date drops the attribute and leaves a session cookie that stores (a name=value cell).
So on the past-dated rows a `❌` means the engine **parsed** the date and a stored cell means it could not — the reverse of the intuitive reading — which turns the `date-*` rows into an engine date-parser map (Firefox, for one, accepts `24:00:00`, `31 Feb`, and `11/06/1994` where Chromium refuses them).

The `☢️` marker is the *expectation-compliance* axis, mirroring consensus onto kekse: it flags a response cell whose tool **parsed the wire differently than kekse did**, kekse being the reference we assert is correct.
Most fire where a tool stores a cookie kekse refuses as malformed — an interior `"`, a raw non-ASCII or DEL byte, a smuggled CR/LF (stored as the truncated prefix), a `SameSite` token kekse drops as unknown — so the rows where real clients are more permissive than kekse are visible at a glance rather than buried in a divergent cell.
A jar's storage-effective values — a substituted default-path (rendered `Path⇒default`, uniform across the browser, curl/wget/libcurl and `HttpClient5` columns), a derived host — and its folded `Max-Age`/`Expires` are *not* parse disagreements and never raise the marker; the HTML report's hover shows every field, contradiction and lossy alike.

Jar probes: the rfc_6265 reference, Rust's cookie_store, Python's `http.cookiejar`, Node's tough-cookie, and the three browser engines (a real store-then-navigate round trip — the server reports the `Cookie` header the engine actually attached) answer today; the Go, .NET, and Java client jars and the curl/wget transfer view are follow-ups (their sidecars answer `n/a` per protocol v2).

The same matrix is written beside this file as `COOKIE_MATRIX.csv`.

## Tested against

- `Rust — kekse (this tree), cookie 0.18.1, biscotti 0.4.3, axum-extra 0.10.3`
- `Python 3.13.14 — SimpleCookie stdlib, http.cookiejar stdlib, Werkzeug 3.1.8, mitmproxy 12.2.3`
- `Node 24.18.0 — cookie 0.7.2, tough-cookie 5.1.2, set-cookie-parser 3.1.1, universal-cookie 8.1.2, js-cookie 3.0.8`
- `Go 1.26.5 — net/http stdlib`
- `.NET 8.0.29 — Microsoft.Net.Http.Headers 8.0.0.0`
- `PHP 8.5.8 — $_COOKIE SAPI cli-server`
- `OpenResty 1.31.1.1 — $cookie_<name> ngx_http_variables, lua-resty-cookie 0.01, proxy ngx_http_proxy_module, proxy (Set-Cookie) ngx_http_proxy_module`
- `Java 25.0.3 — Tomcat RFC6265 9.0.118, Tomcat legacy 9.0.118, Jakarta RESTEasy 6.2.16.Final, Jakarta Jersey 3.1.11, java.net.HttpCookie JDK 25.0.3, Apache HttpClient5 5.6.1`
- `libcurl 8.14.1 — libcurl 8.14.1`
- `shell client driver — curl curl 8.14.1 (x86_64-pc-linux-gnu) libcurl/8.14.1 OpenSSL/3.5.6 zlib/1.3.1 brotli/1.1.0 zstd/1.5.7 libidn2/2.3.8 libpsl/0.21.2 libssh2/1.11.1 nghttp2/1.64.0 nghttp3/1.8.0 librtmp/2.3 OpenLDAP/2.6.10, wget GNU Wget 1.25.0 built on linux-gnu.`
- `browser webdriver driver — chromium Google Chrome for Testing 149.0.7827.155, firefox Mozilla Firefox 152.0.3, edge Microsoft Edge 149.0.4022.98`

[gronke/kekse](https://github.com/gronke/kekse) · MIT licensed