Get the latest tech news
Handling cookies is a minefield
Discrepancies in how browsers and libraries handle HTTP cookies, and the problems caused by such things.
Golang falls relatively close to what the RFC's wording on how servers should behave with Set-Cookie, only differing by allowing 0x20(space) and 0x2C(comma) due to them commonly occurring in the wild. Fixing it on the server-side is potentially feasible, but it affects millions of websites and most of the errors caused by this problem are buried deep in programming languages and web frameworks. Po-Ning Tseng, for helping me investigate this issue in the first place Dan Veditz at Mozilla, for his inexhaustible knowledge and endless kindness Frederik Braun, for his helpful early feedback Steven Bingler at Google, for pushing on getting this issue fixed Peter Bowen, for his thoughts on how cookie processing probably should happen Chris Palmer and David Schinazi, for their insightful proofreading Stefan Bühler, who stumbled across some of this stuff over a decade ago
Or read this on Hacker News