Code change:
contained in the set-cookie-string, and the unparsed-attributes is the empty string. <del> If the name-value-pair string lacks a %x3D ("=") character, ignore the set-cookie-string entirely. </del> <ins> If the name-value-pair string lacks a %x3D ("=") character, then the name string is empty, and the value string is the value of name-value-pair. </ins> <del> The (possibly empty) name string consists of the characters up to, but not including, the first %x3D ("=") character, and the (possibly empty) value string consists of the characters after the first %x3D ("=") character. </del> <ins> Otherwise, the name string consists of the characters up to, but not including, the first %x3D ("=") character, and the (possibly empty) value string consists of the characters after the first %x3D ("=") character. </ins> Remove any leading or trailing WSP characters from the name string and the value string. <del> If the name string is empty, ignore the set-cookie-string entirely. </del> <ins> If both the name string and the value string are empty, ignore the set-cookie-string entirely. </ins> The cookie-name is the name string, and the cookie-value is the value string.

Related discussion:
text: Maybe a lot less users than I think are getting this cookie but given I’ve spotted it on 3 major news paper sites in 3 distinct countries, without having to look too far for these examples, makes me suspect that is not the case. says Facebook assets are being used on 2.38% of the most used 5.7 million sites and I’d guess they all come with some cookies for free. And that stat treats each of those 5.7 million sites equally when actual usage will be heavily skewed to the sites at the top end than the tail so usage will likely be more than that as top end sites are more likely to use Facebook advertising in my opinion. And again, I’m not concerned with this Facebook example - but more that it seems to suggest the 0.12% stat feels wrong. Or maybe it’s not being included since this empty cookie doesn’t seem to be sent in follow up requests, and that’s what that stat is measuring? If that’s the reason, and we’re comfortable with that explanation and the risks that entails (I am for what it’s worth), then that’s fine, but thought it worth asking the question.
As NAME notes above, we don't have statistics on cookie size generally; just aggregate numbers on header length. The "0.12% of users" statistic is the set of users who have ever sent an empty header (e.g. the only cookie they have for a given request is empty). If nameless/valueless cookies are set for other sites, they'll be serialized as , which we don't track specifically. I noted above that I'm less concerned about this case than I am about the "We used to get a header, but now we don't get anything at all!" case, but I'm honestly not terribly concerned about either given the existing diversity in the way browsers handle .
OK makes sense. Thanks for answering.
Yes, that's right.
The CFNetwork team approves of the change and is tracking the work in rdar://problem/58358759.
Given that, I'd suggest that we land something like URL along with the tests from https://chromium-URL Thanks! If you'd like to improve compatibility with IE and Firefox, you might consider representing these as nameless cookies instead of valueless cookie. You can observe the difference via test 0027: Set-Cookie: foo Set-Cookie: bar