RFC 6265 section 4.1.1 says a server should accept this range: cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E Yet, Firefox and Chrome as of June 2022 accept space, comma and double-quotes fine. The prime reason for filtering out control bytes is that some HTTP servers return 400 for requests that contain such. */
source not stored for this graph (policy: none)
no outgoing calls
no test coverage detected