The Set-Cookie value has no valid name=value pair.

COOKIE_INVALID · Severity: Error

• ErrorCOOKIE_INVALID

  The Set-Cookie value has no valid name=value pair.

  A cookie starts with name=value before any attribute, and a quoted value has a closing quote and no semicolon or comma inside. Otherwise browsers store a cookie with an empty name, cut the value short or drop the header. The evidence names the problem.

  Recommendation: Start the value with the cookie's name, an equals sign and its value, and keep semicolons and commas out of the value.

Reported by

• Set-Cookie parser

Available through the API

• Set-Cookie parser API

Related findings

• Info COOKIE_LONG_LIFETIME The cookie asks to live longer than the 400 days browsers allow.
• Info COOKIE_MULTIPLE The text holds more than one cookie; only the first was checked.
• Warning COOKIE_NOT_SECURE The HTTPS site sets a cookie without the Secure attribute.
• Info COOKIE_NO_HTTPONLY The cookie can be read by scripts (no HttpOnly attribute).
• Info COOKIE_NO_SAMESITE The cookie has no SameSite attribute.
• Warning COOKIE_NO_SECURE The cookie has no Secure attribute.

All findings