{"record":{"id":"7e43b8f0d2580924","repo":"valyala/fasthttp","slug":"fasthttp-invalid-cookie-value","errorCode":null,"errorMessage":"fasthttp: invalid cookie value","messagePattern":"fasthttp: invalid cookie value","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"cookie.go","lineNumber":380,"sourceCode":"\treturn c.bufK\n}\n\n// String returns cookie representation.\nfunc (c *Cookie) String() string {\n\treturn string(c.Cookie())\n}\n\n// WriteTo writes cookie representation to w.\n//\n// WriteTo implements io.WriterTo interface.\nfunc (c *Cookie) WriteTo(w io.Writer) (int64, error) {\n\tn, err := w.Write(c.Cookie())\n\treturn int64(n), err\n}\n\nvar (\n\tErrNoCookies          = errors.New(\"fasthttp: no cookies found\")\n\tErrInvalidCookieValue = errors.New(\"fasthttp: invalid cookie value\")\n)\n\n// Parse parses Set-Cookie header.\nfunc (c *Cookie) Parse(src string) error {\n\tc.bufK = append(c.bufK[:0], src...)\n\treturn c.ParseBytes(c.bufK)\n}\n\n// ParseBytes parses Set-Cookie header.\nfunc (c *Cookie) ParseBytes(src []byte) error {\n\tc.Reset()\n\n\tvar s cookieScanner\n\ts.b = src\n\n\tvar k, v []byte\n\tif !s.nextRaw(&k, &v) {\n\t\treturn ErrNoCookies","sourceCodeStart":362,"sourceCodeEnd":398,"githubUrl":"https://github.com/valyala/fasthttp/blob/c96f600972c6f4a7a30d664257b340ebe9d60124/cookie.go#L362-L398","documentation":"ErrInvalidCookieValue is returned by Cookie.Parse/ParseBytes when a Set-Cookie value fails validation, e.g. a quoted value containing illegal characters like a semicolon outside quotes. fasthttp rejects values it deems unsafe per RFC 6265 parsing rules.","triggerScenarios":"Parsing a Set-Cookie header whose value contains characters such as ';', or a quoted value with mismatched/illegal characters; server sending non-conformant Set-Cookie headers.","commonSituations":"Integrating with legacy servers that emit loosely formatted Set-Cookie values; hand-constructed Set-Cookie strings with unescaped semicolons or commas; unit tests asserting strict cookie validation.","solutions":["Sanitize/escape the cookie value on the sender side (no semicolons, commas, or whitespace outside quotes)","Pre-validate the Set-Cookie string before Cookie.ParseBytes and reject or fix malformed values","Skip or log the offending cookie instead of failing the whole response parse","If the peer is controlled, fix the server's Set-Cookie formatting"],"exampleFix":"// before\nvar c fasthttp.Cookie\nc.ParseBytes(setCookieValue) // panics-free but returns ErrInvalidCookieValue\n// after\nif err := (fasthttp.Cookie{}).ParseBytes(setCookieValue); err == fasthttp.ErrInvalidCookieValue {\n    fixed := sanitizeCookieValue(setCookieValue) // strip/escape ';', whitespace\n    // retry with sanitized value or skip\n}","handlingStrategy":"validation","validationCode":"func validCookieValue(v string) bool {\n    for _, r := range v {\n        if r <= ' ' || r == ';' || r == ',' || r == '\\\\' || r == '\"' {\n            return false\n        }\n    }\n    return len(v) > 0\n}\nif !validCookieValue(val) { /* fix or skip before Parse */ }","typeGuard":null,"tryCatchPattern":"if err := c.ParseBytes(raw); errors.Is(err, fasthttp.ErrInvalidCookieValue) {\n    log.Warnf(\"skipping malformed cookie: %q\", raw)\n    return nil\n}","preventionTips":["Escape cookie values with net/url.QueryEscape or base64","Never put ';', ',', or raw quotes in cookie values","Validate Set-Cookie input from third parties","Fix server-side Set-Cookie formatting"],"tags":["fasthttp","cookies","validation","parsing"],"backgroundTag":"invalid-cookie-value","analyzedSha":"c96f600972c6f4a7a30d664257b340ebe9d60124","analyzedAt":"2026-08-31T22:48:28.265Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}