$cookie_name variable inconsistent cookie-pair splitting

[auseviciusdev@…]

$cookie_name variable cookie pair splitting is inconsistent and looks to be not complying to rfc6265

According to ​https://tools.ietf.org/html/rfc6265#section-4.2.1 cookie pairs are split by ';' followed with space.

   cookie-header = "Cookie:" OWS cookie-string OWS
   cookie-string = cookie-pair *( ";" SP cookie-pair )

I found that Nginx is splitting on ';' and ',' (only unique cookie names?) with optional spaces.

I have the following block:

location / {
  return 200 $cookie_PHPSESSID\n;
}

Test cases:

root@6637fda45745:/etc/nginx/conf.d# curl localhost -H "Cookie: PHPSESSID=one; PHPSESSID=two"
one
root@6637fda45745:/etc/nginx/conf.d# curl localhost -H "Cookie: PHPSESSID=one;PHPSESSID=two"
one
root@6637fda45745:/etc/nginx/conf.d# curl localhost -H "Cookie: PHPSESSID=one PHPSESSID=two"
one PHPSESSID=two
root@6637fda45745:/etc/nginx/conf.d# curl localhost -H "Cookie: PHPSESSID=one, PHPSESSID=two"
one, PHPSESSID=two
root@6637fda45745:/etc/nginx/conf.d# curl localhost -H "Cookie: PHPSESSID=one,PHPSESSID=two"
one,PHPSESSID=two
root@6637fda45745:/etc/nginx/conf.d# curl localhost -H "Cookie: ID=one, PHPSESSID=two"
two
root@6637fda45745:/etc/nginx/conf.d# curl localhost -H "Cookie: ID=one PHPSESSID=two"

root@6637fda45745:/etc/nginx/conf.d# curl localhost -H "Cookie: PHPSESSID = one; PHPSESSID=two"
one
root@6637fda45745:/etc/nginx/conf.d# curl localhost -H "Cookie: PHPSESSID = one PHPSESSID=two"
one PHPSESSID=two
root@6637fda45745:/etc/nginx/conf.d# curl localhost -H "Cookie: PHPSESSID = one, PHPSESSID=two"
one, PHPSESSID=two

Other syntax error is allowing spaces between cookie-name and cookie-value (not allowed in ​https://tools.ietf.org/html/rfc6265#section-4.1.1).
I'm wondering why is this done like this, or is there a document that follows this syntax?

Thank you

[Maxim Dounin]

To parse cookies for the $cookie_* variables nginx uses permissive syntax from ​RFC 2109 and RFC 2965, which permits list values in the Cookie header to be separated by either ; (as historically used by the Cookie header) or ',' (as normally used by lists in HTTP, and required as an alternative separator by RFC 2109/2965):

   The syntax for the header is:

   cookie          =       "Cookie:" cookie-version
                           1*((";" | ",") cookie-value)
   cookie-value    =       NAME "=" VALUE [";" path] [";" domain]
   cookie-version  =       "$Version" "=" value
   NAME            =       attr
   VALUE           =       value
   path            =       "$Path" "=" value
   domain          =       "$Domain" "=" value

   ...

   Note: For backward compatibility, the separator in the Cookie header
   is semi-colon (;) everywhere.  A server should also accept comma (,)
   as the separator between cookie-values for future compatibility.

The same applies to spaces, which aren't used to be explicitly specified by grammars, but rather assumed ​implicitly:

   ... White space is permitted between tokens. ...

Switching to strict parsing per RFC 6265 grammar is possible, but unlikely unless there are practical reasons to do so. Especially given that ​RFC 6265 itself uses permissive approach in example algorithms it provides.

   NOTE: The algorithm below is more permissive than the grammar in
   Section 4.1.  For example, the algorithm strips leading and trailing
   whitespace from the cookie name and value (but maintains internal
   whitespace), whereas the grammar in Section 4.1 forbids whitespace in
   these positions.  User agents use this algorithm so as to
   interoperate with servers that do not follow the recommendations in
   Section 4.

If you think there are practical reasons to change the parsing, please elaborate.

[Maxim Dounin]

Feedback timeout.