Is the HTTP header `Set-Cookie: foobar` setting the name or the value of the cookie?

Question

It's not a question about sense but about specification.

A HTTP cookie must be set like

Set-Cookie: <cookieValue>[; <attribute>][; <attribute>]

cookieValue is recommended to be set as

<key>=<value>

but can be a single value without an equal sign, because the equal sign is not recommended by specification but by common usage. So if I set a cookie like

Set-Cookie: foobar

Does foobar will be set as the cookie key or the cookie value?

I'm developing a CURL wrapper and I'm on the cookie implementation right now. But the handling of a equal-sign-less cookie value isn't quite obvious to do it right.

If I missed some specification answering my question I'd be happy to get links into that specification.

Answer 1

If there is no equal sign in the cookie value the set-cookie header must be ignored completely.

Explanation

https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-05#section-5.3

A user agent MUST use an algorithm equivalent to the following algorithm to parse a set-cookie-string:

This states the following steps are the way how to implement it.

2. If the name-value-pair string lacks a %x3D ("=") character, then the name string is empty, and the value string is the value of name-value-pair.

   Otherwise, the name string consists of the characters up to, but not including, the first %x3D ("=") character, and the (possibly empty) value string consists of the characters after the first %x3D ("=") character.

[...]

4. If both the name string and the value string are empty, ignore the set-cookie-string entirely.

There might be an inconsistency with that steps.

Will the cookie set with a value without a name? Or will the set-cookie-string be ignored completely.

In fact these steps must been read as mentioned as "steps of implementation". So the 4th step applies AFTER the 2nd step. After the 2nd step the cookie name is empty and in the 4th step that empty cookie name leads to the conclusion to ignore the set-cookie header.