Parse Cookie and Set-Cookie

Back to the cloakroom. Set-Cookie is the attendant handing you a ticket, with small print on the back: "valid for one year", "only show this at the main desk", "do not show it to other venues". Cookie is you handing back all your tickets for that desk at once, small print left off.

The attributes you will parse

• Expires=Thu, 01 Oct 2026 00:00:00 GMT: forget the cookie at this date. Keep the text for now; the cookie jar will turn it into a time.
• Max-Age=3600: forget it after this many seconds. Zero or negative means delete now. If both are present, Max-Age wins.
• Domain=shopa.example: also send to subdomains. A leading dot (.shopa.example) is ignored, and names are compared in lower case.
• Path=/account: only send for addresses under this path. A value not starting with / is ignored.
• Secure: only over HTTPS. HttpOnly: page scripts cannot read it.
• SameSite=Strict, Lax or None: whether it goes along on requests from other sites. Any other value counts as not given.
• Partitioned: keep a separate copy for each top-level site (CHIPS, from Leg 1).

The careful parts

Browsers are forgiving on purpose, and your parser should be too. Attribute names ignore case, so secure and SECURE both count. Spaces around = and ; are allowed. An attribute the browser does not know (Priority=High, or a typo) is skipped, not an error. Values can contain =, as in token=a=b, so split at the first = only.

Some lines are ignored completely: a first part with no = at all, or with an empty name. The current cookie rules, draft-ietf-httpbis-rfc6265bis (approved as a standard and awaiting its RFC number, checked October 2026), allow a few unusual nameless cookies; our practice browser keeps it simple and ignores them, and so will you.

parse_set_cookie("id=7f3a; Max-Age=600; domain=.ShopA.example; Path=/; secure; SameSite=lax")
# {"name": "id", "value": "7f3a", "expires": None, "max_age": 600,
#  "domain": "shopa.example", "path": "/", "secure": True, "httponly": False,
#  "samesite": "Lax", "partitioned": False}

A common misconception

"The Cookie header tells the server when my cookie expires." It does not. The browser keeps all the small print to itself and sends only name=value. A server that wants to know how long a cookie lasts has to remember what it set.

function parseSetCookie(line) {
  const [first, ...attrs] = line.split(";");
  const i = first.indexOf("=");
  if (i < 0 || !first.slice(0, i).trim()) return null;
  const c = { name: first.slice(0, i).trim(), value: first.slice(i + 1).trim() };
  for (const a of attrs) {
    const j = a.indexOf("=");
    const key = (j < 0 ? a : a.slice(0, j)).trim().toLowerCase();
    const val = j < 0 ? "" : a.slice(j + 1).trim();
    if (key === "secure") c.secure = true;
    else if (key === "max-age" && /^-?\d+$/.test(val)) c.maxAge = Number(val);
    // ... and the rest, as in Python
  }
  return c;
}

// Go parses both for you: http.ParseSetCookie (Go 1.23+) and http.ParseCookie
c, err := http.ParseSetCookie("id=7f3a; Max-Age=600; Secure; SameSite=Lax")
if err == nil {
    fmt.Println(c.Name, c.Value, c.MaxAge, c.Secure, c.SameSite)
}

// a server sets a cookie with every attribute named:
setcookie('sid', $id, ['expires' => time() + 3600, 'path' => '/',
    'secure' => true, 'httponly' => true, 'samesite' => 'Lax']);