What causes "fasthttp: invalid cookie value" in valyala/fasthttp?

Sanitize/escape the cookie value on the sender side (no semicolons, commas, or whitespace outside quotes)

fasthttp: invalid cookie value

Error message

fasthttp: invalid cookie value

What it means

ErrInvalidCookieValue is returned by Cookie.Parse/ParseBytes when a Set-Cookie value fails validation, e.g. a quoted value containing illegal characters like a semicolon outside quotes. fasthttp rejects values it deems unsafe per RFC 6265 parsing rules.

Source

Thrown at cookie.go:380

	return c.bufK
}

// String returns cookie representation.
func (c *Cookie) String() string {
	return string(c.Cookie())
}

// WriteTo writes cookie representation to w.
//
// WriteTo implements io.WriterTo interface.
func (c *Cookie) WriteTo(w io.Writer) (int64, error) {
	n, err := w.Write(c.Cookie())
	return int64(n), err
}

var (
	ErrNoCookies          = errors.New("fasthttp: no cookies found")
	ErrInvalidCookieValue = errors.New("fasthttp: invalid cookie value")
)

// Parse parses Set-Cookie header.
func (c *Cookie) Parse(src string) error {
	c.bufK = append(c.bufK[:0], src...)
	return c.ParseBytes(c.bufK)
}

// ParseBytes parses Set-Cookie header.
func (c *Cookie) ParseBytes(src []byte) error {
	c.Reset()

	var s cookieScanner
	s.b = src

	var k, v []byte
	if !s.nextRaw(&k, &v) {
		return ErrNoCookies

View on GitHub (pinned to c96f600972)

Solutions

Sanitize/escape the cookie value on the sender side (no semicolons, commas, or whitespace outside quotes)
Pre-validate the Set-Cookie string before Cookie.ParseBytes and reject or fix malformed values
Skip or log the offending cookie instead of failing the whole response parse
If the peer is controlled, fix the server's Set-Cookie formatting

Example fix

// before
var c fasthttp.Cookie
c.ParseBytes(setCookieValue) // panics-free but returns ErrInvalidCookieValue
// after
if err := (fasthttp.Cookie{}).ParseBytes(setCookieValue); err == fasthttp.ErrInvalidCookieValue {
    fixed := sanitizeCookieValue(setCookieValue) // strip/escape ';', whitespace
    // retry with sanitized value or skip
}

Defensive patterns

Strategy: validation

Validate before calling

func validCookieValue(v string) bool {
    for _, r := range v {
        if r <= ' ' || r == ';' || r == ',' || r == '\\' || r == '"' {
            return false
        }
    }
    return len(v) > 0
}
if !validCookieValue(val) { /* fix or skip before Parse */ }

Try / catch

if err := c.ParseBytes(raw); errors.Is(err, fasthttp.ErrInvalidCookieValue) {
    log.Warnf("skipping malformed cookie: %q", raw)
    return nil
}

Prevention

Escape cookie values with net/url.QueryEscape or base64
Never put ';', ',', or raw quotes in cookie values
Validate Set-Cookie input from third parties
Fix server-side Set-Cookie formatting

When it happens

Trigger: Parsing a Set-Cookie header whose value contains characters such as ';', or a quoted value with mismatched/illegal characters; server sending non-conformant Set-Cookie headers.

Common situations: Integrating with legacy servers that emit loosely formatted Set-Cookie values; hand-constructed Set-Cookie strings with unescaped semicolons or commas; unit tests asserting strict cookie validation.

Related errors

AI-assisted analysis of valyala/fasthttp@c96f600972 (2026-08-31). Data as JSON: /api/errors/7e43b8f0d2580924. Report an issue: GitHub.