Cookies specification compliance issues in modern browsers

research by Ivan Nikulin
(email: ifaaan@gmail.com, github: inikulin, twitter: _inikulin_)

This table lists RFC 6265 compliance issues found in modern browsers. Data was obtained by running the IETF test suite across major browsers using a specially made test runner. Test fails are divided into categories for the working group to distinguish implementation bugs from de facto standards that should make their way to the specification.

Issue groups:

- Test fails in all browsers with the identical results.
- Test fails in all browsers, but with different results. Possible de facto standard.
- Test fails in the majority of browsers with the identical results. Possible de facto standard.
- Test fails in the majority of browsers, but with different results.
- Test fails in the minority of browsers. More likely it's an implementation bug than planned behavior.
- Test fails only in one browser. Implementation bug.

Note: all cookies are set on page http://home.example.org:8888/test and results are inspected on http://home.example.org:8888/cookie-parser-result, except for those tests where the results URL is explicitly specified.
IETF test(71)ExpectedSafari(v9.0.0)
45 : 26		IE(v11.0.0)
38 : 33		Edge(v12.10240.0)
38 : 33		IE (Codepage: big5)(v11.0.0)
38 : 33		Edge (Codepage: big5)(v13.10586.0)
38 : 33		IE (Codepage: shift_jis)(v11.0.0)
38 : 33		Edge (Codepage: shift_jis)(v13.10586.0)
38 : 33		Chrome(v49.0.2623)
24 : 47		Firefox(v44.0.0)
21 : 50
0004#
All / no consensus (9 : 0)

Set cookie:
"foo"		"""foo=""foo""foo""foo""foo""foo""foo""foo""foo"
0027#
All / no consensus (9 : 0)

Set cookie:
"foo"
"bar"		"""bar=; foo=""bar""bar""bar""bar""bar""bar""bar""bar"
MOZILLA0012#
All / no consensus (9 : 0)

Set cookie:
"test=\"fubar! = foo;bar\\\";\" parser; max-age=6"
"five; max-age=2.63,"		"test=\"fubar! = foo""test=\"fubar! = foo;bar\\\"""test=\"fubar! = foo; five""test=\"fubar! = foo; five""test=\"fubar! = foo; five""test=\"fubar! = foo; five""test=\"fubar! = foo; five""test=\"fubar! = foo; five""test=\"fubar! = foo; five""test=\"fubar! = foo; five"
MOZILLA0014#
All / no consensus (9 : 0)

Set cookie:
"six"		"""six=""six""six""six""six""six""six""six""six"
MOZILLA0015#
All / no consensus (9 : 0)

Set cookie:
"six"
"seven"		"""seven=; six=""seven""seven""seven""seven""seven""seven""seven""seven"
MOZILLA0016#
All / no consensus (9 : 0)

Set cookie:
"six"
"seven"
" =eight"		"""seven=; six=""eight""eight""eight""eight""eight""eight""eight""eight"
MOZILLA0017#
All / no consensus (9 : 0)

Set cookie:
"six"
"seven"
" =eight"
"test=six"		"test=six""seven=; six=; test=six""eight; test=six""eight; test=six""eight; test=six""eight; test=six""eight; test=six""eight; test=six""eight; test=six""eight; test=six"
NAME0033#
All / no consensus (9 : 0)

Set cookie:
"=foo=bar"
"aaa"		"""aaa=""aaa""aaa""aaa""aaa""aaa""aaa""aaa""aaa"
0021#
Majority (8 : 1)

Set cookie:
"a=b"
"=x"
"c=d"		"a=b; c=d""a=b; x; c=d""a=b; x; c=d""a=b; x; c=d""a=b; x; c=d""a=b; x; c=d""a=b; x; c=d""a=b; x; c=d""a=b; x; c=d"
CHROMIUM0009#
Majority (8 : 1)

Set cookie:
"BLAHHH; path=/;"		"""BLAHHH""BLAHHH""BLAHHH""BLAHHH""BLAHHH""BLAHHH""BLAHHH""BLAHHH"
CHROMIUM0010#
Majority (8 : 1)

Set cookie:
"\"BLA\\\"HHH\"; path=/;"		"""\"BLA\\\"HHH\"""\"BLA\\\"HHH\"""\"BLA\\\"HHH\"""\"BLA\\\"HHH\"""\"BLA\\\"HHH\"""\"BLA\\\"HHH\"""\"BLA\\\"HHH\"""\"BLA\\\"HHH\""
CHROMIUM0012#
Majority (8 : 1)

Set cookie:
"=ABC"		"""ABC""ABC""ABC""ABC""ABC""ABC""ABC""ABC"
NAME0017#
Majority (8 : 1)

Set cookie:
"=a=bar"		"""a=bar""a=bar""a=bar""a=bar""a=bar""a=bar""a=bar""a=bar"
NAME0023#
Majority (8 : 1)

Set cookie:
"foo;bar=baz"		"""foo""foo""foo""foo""foo""foo""foo""foo"
NAME0025#
Majority (8 : 1)

Set cookie:
"===a=bar"		"""==a=bar""==a=bar""==a=bar""==a=bar""==a=bar""==a=bar""==a=bar""==a=bar"
NAME0028#
Majority (8 : 1)

Set cookie:
"=a"		"""a""a""a""a""a""a""a""a"
NAME0031#
Majority (8 : 1)

Set cookie:
"\"foo;bar\"=baz"		"""\"foo""\"foo""\"foo""\"foo""\"foo""\"foo""\"foo""\"foo"
NAME0032#
Majority (8 : 1)

Set cookie:
"\"foo\\\"bar;baz\"=qux"		"""\"foo\\\"bar""\"foo\\\"bar""\"foo\\\"bar""\"foo\\\"bar""\"foo\\\"bar""\"foo\\\"bar""\"foo\\\"bar""\"foo\\\"bar"
DOMAIN0023#
Majority (7 : 2)

Set cookie:
"foo2=bar2; domain=.example.org"
"foo=bar; domain=home.example.org"

Results URL:
http://home.example.org:8888/cookie-parser-result?domain0023		"foo2=bar2; foo=bar""foo=bar; foo2=bar2""foo=bar; foo2=bar2""foo=bar; foo2=bar2""foo=bar; foo2=bar2""foo=bar; foo2=bar2""foo=bar; foo2=bar2""foo=bar; foo2=bar2"
PATH0027#
Majority (7 : 2)

Set cookie:
"foo=bar; path=\"/cookie-parser-result/foo/qux;\""

Results URL:
/cookie-parser-result/foo/qux?path0027		"foo=bar"""""""""""""""
0006#
Majority (6 : 3)

Set cookie:
"foo=bar; max-age=0;"		"""foo=bar""foo=bar""foo=bar""foo=bar""foo=bar""foo=bar"
DISABLED_CHROMIUM0020#
Majority (6 : 3)

Set cookie:
Cookie is too long. Hover to view.
""
Cookie is too long. Hover to view.
Cookie is too long. Hover to view.
Cookie is too long. Hover to view.
Cookie is too long. Hover to view.
Cookie is too long. Hover to view.
Cookie is too long. Hover to view.
DISABLED_CHROMIUM0023#
Majority (6 : 3)

Set cookie:
"AAA=BB\rZYX"		"AAA=BB""AAA=BB_ZYX""AAA=BB_ZYX""AAA=BB_ZYX""AAA=BB_ZYX""AAA=BB_ZYX""AAA=BB_ZYX"
DOMAIN0029#
Majority (6 : 3)

Set cookie:
"foo=bar"

Results URL:
http://subdomain.home.example.org:8888/cookie-parser-result?domain0029		"""foo=bar""foo=bar""foo=bar""foo=bar""foo=bar""foo=bar"
MOZILLA0001#
Majority (6 : 3)

Set cookie:
"foo=bar; max-age=-1"		"""foo=bar""foo=bar""foo=bar""foo=bar""foo=bar""foo=bar"
MOZILLA0002#
Majority (6 : 3)

Set cookie:
"foo=bar; max-age=0"		"""foo=bar""foo=bar""foo=bar""foo=bar""foo=bar""foo=bar"
MOZILLA0005#
Majority (6 : 3)

Set cookie:
"foo=bar; max-age=-20"		"""foo=bar""foo=bar""foo=bar""foo=bar""foo=bar""foo=bar"
MOZILLA0009#
Majority (6 : 3)

Set cookie:
"foo=bar; max-age=60"
"foo1=bar; max-age=60"
"foo=differentvalue; max-age=0"		"foo1=bar""foo=differentvalue; foo1=bar""foo=differentvalue; foo1=bar""foo=differentvalue; foo1=bar""foo=differentvalue; foo1=bar""foo=differentvalue; foo1=bar""foo=differentvalue; foo1=bar"
MOZILLA0010#
Majority (6 : 3)

Set cookie:
"foo=bar; max-age=60"
"foo1=bar; max-age=60"
"foo=differentvalue; max-age=0"
"foo2=evendifferentvalue; max-age=0"		"foo1=bar""foo=differentvalue; foo1=bar; foo2=evendifferentvalue""foo=differentvalue; foo1=bar; foo2=evendifferentvalue""foo=differentvalue; foo1=bar; foo2=evendifferentvalue""foo=differentvalue; foo1=bar; foo2=evendifferentvalue""foo=differentvalue; foo1=bar; foo2=evendifferentvalue""foo=differentvalue; foo1=bar; foo2=evendifferentvalue"
MOZILLA0013#
Majority (6 : 3)

Set cookie:
"test=kill; max-age=0"
"five; max-age=0"		"""test=kill; five""test=kill; five""test=kill; five""test=kill; five""test=kill; five""test=kill; five"
OPTIONAL_DOMAIN0030#
Majority (6 : 3)

Set cookie:
"foo=bar; domain="

Results URL:
http://home.example.org:8888/cookie-parser-result?optional-domain0030		"foo=bar"""""""""""""
OPTIONAL_DOMAIN0041#
Majority (6 : 3)

Set cookie:
"foo=bar; domain=example.org; domain="

Results URL:
http://home.example.org:8888/cookie-parser-result?optional-domain0041		"foo=bar"""""""""""""
PATH0024#
Majority (6 : 3)

Set cookie:
"foo=bar; path=/cookie-parser-result/foo/qux?"

Results URL:
/cookie-parser-result/foo/qux?path0024		"""foo=bar""foo=bar""foo=bar""foo=bar""foo=bar""foo=bar"
PATH0025#
Majority (6 : 3)

Set cookie:
"foo=bar; path=/cookie-parser-result/foo/qux#"

Results URL:
/cookie-parser-result/foo/qux?path0025		"""foo=bar""foo=bar""foo=bar""foo=bar""foo=bar""foo=bar"
CHARSET0001#
Majority / no consensus (7 : 2)

Set cookie:
"foo=春节回家路·春运完全手册"		"foo=春节回家路·春运完全手册""foo=""foo=?????�??????""foo=?????�??????""foo=�K?�^�a���P�K?������?""foo=�K?�^�a���P�K?������?""foo=�t?���ƘH�E�t?���S���e""foo=�t?���ƘH�E�t?���S���e"
CHARSET0002#
Majority / no consensus (7 : 2)

Set cookie:
"春节回=家路·春运完全手册"		"春节回=家路·春运完全手册""""???=??�??????""???=??�??????""�K?�^=�a���P�K?������?""�K?�^=�a���P�K?������?""�t?��=�ƘH�E�t?���S���e""�t?��=�ƘH�E�t?���S���e"
CHARSET0003#
Majority / no consensus (7 : 2)

Set cookie:
"春节回=家路·春运; 完全手册"		"春节回=家路·春运""""???=??�??""???=??�??""�K?�^=�a���P�K?""�K?�^=�a���P�K?""�t?��=�ƘH�E�t?""�t?��=�ƘH�E�t?"
CHARSET0004#
Majority / no consensus (7 : 2)

Set cookie:
"foo=\"春节回家路·春运完全手册\""		"foo=\"春节回家路·春运完全手册\"""foo=\"""foo=\"?????�??????\"""foo=\"?????�??????\"""foo=\"�K?�^�a���P�K?������?\"""foo=\"�K?�^�a���P�K?������?\"""foo=\"�t?���ƘH�E�t?���S���e\"""foo=\"�t?���ƘH�E�t?���S���e\""
0023#
Minority - possible bug (2 : 7)

Set cookie:
"foo"
""		"""foo=""foo"
0024#
Minority - possible bug (2 : 7)

Set cookie:
"foo"
"="		"""foo=""foo"
0025#
Minority - possible bug (2 : 7)

Set cookie:
"foo"
"; bar"		"""foo=""foo"
0026#
Minority - possible bug (2 : 7)

Set cookie:
"foo"
" "		"""foo=""foo"
0028#
Minority - possible bug (2 : 7)

Set cookie:
"foo"
"\t"		"""foo=""foo"
DISABLED_PATH0029#
Minority - possible bug (2 : 7)

Set cookie:
"foo=bar; path=/cookie-parser-result/foo/bar"

Results URL:
/cookie-parser-result/f%6Fo/bar?disabled-path0029		"foo=bar"""""
OPTIONAL_DOMAIN0042#
Minority - possible bug (2 : 7)

Set cookie:
"foo=bar; domain=foo.example.org; domain="

Results URL:
http://home.example.org:8888/cookie-parser-result?optional-domain0042		"""foo=bar""foo=bar"
0008#
Bug (1 : 8)

Set cookie:
"foo=bar; version=1000;"		"foo=bar"""
0016#
Bug (1 : 8)

Set cookie:
"z=y"
"a=b"		"z=y; a=b""a=b; z=y"
0017#
Bug (1 : 8)

Set cookie:
"z=y, a=b"		"z=y, a=b""z=y,a=b"
0022#
Bug (1 : 8)

Set cookie:
"a=b"
"x="
"c=d"		"a=b; x=; c=d""a=b; c=d; x="
ATTRIBUTE0021#
Bug (1 : 8)

Set cookie:
"foo=bar; Path=/qux; Path=/"		"foo=bar"""
ATTRIBUTE0022#
Bug (1 : 8)

Set cookie:
"foo=bar; Path=/; Path=/qux"		"""foo=bar"
ATTRIBUTE0023#
Bug (1 : 8)

Set cookie:
"foo=bar; Path=/qux; Path=/cookie-parser-result"		"foo=bar"""
ATTRIBUTE0024#
Bug (1 : 8)

Set cookie:
"foo=bar; Path=/cookie-parser-result; Path=/qux"		"""foo=bar"
CHROMIUM0004#
Bug (1 : 8)

Set cookie:
"aBc=\"zz;pp\" ; ;"		"aBc=\"zz""aBc=\"zz;pp\""
CHROMIUM0015#
Bug (1 : 8)

Set cookie:
" A=== BC ;foo;;; bar"		"A=== BC""A===BC"
COMMA0001#
Bug (1 : 8)

Set cookie:
"foo=bar, baz=qux"		"foo=bar, baz=qux""foo=bar,baz=qux"
DOMAIN0014#
Bug (1 : 8)

Set cookie:
"foo=bar; domain=home.example.org."

Results URL:
http://home.example.org:8888/cookie-parser-result?domain0014		"""foo=bar"
DOMAIN0020#
Bug (1 : 8)

Set cookie:
"foo2=bar2; domain=.home.example.org"
"foo=bar; domain=home.example.org"

Results URL:
http://home.example.org:8888/cookie-parser-result?domain0020		"foo2=bar2; foo=bar""foo=bar; foo2=bar2"
DOMAIN0024#
Bug (1 : 8)

Set cookie:
"foo=bar; domain=.example.org; domain=home.example.org"

Results URL:
http://sibling.example.org:8888/cookie-parser-result?domain0024		"""foo=bar"
DOMAIN0025#
Bug (1 : 8)

Set cookie:
"foo=bar; domain=home.example.org; domain=.example.org"

Results URL:
http://sibling.example.org:8888/cookie-parser-result?domain0025		"foo=bar"""
DOMAIN0031#
Bug (1 : 8)

Set cookie:
"foo=bar; domain=home.example.org; domain=.example.org"

Results URL:
http://sibling.example.org:8888/cookie-parser-result?domain0031		"foo=bar"""
DOMAIN0034#
Bug (1 : 8)

Set cookie:
"foo=bar; domain=home.example.org; domain=home.example.com"

Results URL:
http://home.example.org:8888/cookie-parser-result?domain0034		"""foo=bar"
DOMAIN0035#
Bug (1 : 8)

Set cookie:
"foo=bar; domain=home.example.com; domain=home.example.org"

Results URL:
http://home.example.org:8888/cookie-parser-result?domain0035		"foo=bar"""
NAME0020#
Bug (1 : 8)

Set cookie:
"\"a=b\"=bar"		"\"a=b\"=bar"""
ORDERING0001#
Bug (1 : 8)

Set cookie:
"key=val0;"
"key=val1; path=/cookie-parser-result"
"key=val2; path=/"
"key=val3; path=/bar"
"key=val4; domain=.example.org"
"key=val5; domain=.example.org; path=/cookie-parser-result/foo"

Results URL:
/cookie-parser-result/foo/baz?ordering0001		"key=val5; key=val1; key=val2; key=val4""key=val1; key=val2; key=val5; key=val4"
PATH0029#
Bug (1 : 8)

Set cookie:
"a=b; \tpath\t=\t/cookie-parser-result\t"
"x=y; \tpath\t=\t/book\t"		"a=b""a=b; x=y"
PATH0030#
Bug (1 : 8)

Set cookie:
"foo=bar; path=/dog; path="		"foo=bar"""
PATH0031#
Bug (1 : 8)

Set cookie:
"foo=bar; path=; path=/dog"		"""foo=bar"
VALUE0004#
Bug (1 : 8)

Set cookie:
"foo=\"bar;baz\""		"foo=\"bar""foo=\"bar;baz\""
VALUE0006#
Bug (1 : 8)

Set cookie:
"\tfoo\t=\tbar\t \t;\tttt"		"foo=bar"""
PATH0014#
Bug (1 : 8)

Set cookie:
"foo=bar; path=/cookie-parser-result/foo/qux/"

Results URL:
/cookie-parser-result/foo/qux?path0014		"""foo=bar"