Wrong cookie parsing with double qoutes

Greg Wilkins added a comment - 29/Jun/09 1:16 AM The issue here is that the specification is not very clear about how to handle quotes. In RFC2109 it says: 4.1 Syntax: General The two state management headers, Set-Cookie and Cookie, have common syntactic properties involving attribute-value pairs. The following grammar uses the notation, and tokens DIGIT (decimal digits) and token (informally, a sequence of non-special, non-white space characters) from the HTTP/1.1 specification [RFC 2068] to describe their syntax. av-pairs = av-pair *(";" av-pair) av-pair = attr ["=" value] ; optional value attr = token value = word word = token | quoted-string But then later is says: 10.1.3 Punctuation In Netscape's original proposal, the values in attribute-value pairs did not accept "-quoted strings. Origin servers should be cautious about sending values that require quotes unless they know the receiving user agent understands them (i.e., "new" cookies). A ("new") user agent should only use quotes around values in Cookie headers when the cookie's version(s) is (are) all compliant with this specification or later. So using quotes is problematic. But in this case, it does look to me that Jetty is not correctly unquoting the value. So I think this is a bug

Greg Wilkins added a comment - 29/Jun/09 7:39 PM I've committed a new cookie parser that handles the quotes better. It would be good if you could check it before the next release