Cookie

A cookie a response sets, as a value that renders its own Set-Cookie string.

eezo writes Set-Cookie by hand rather than through Jetty's Response.addCookie, so that no Jetty type sits in the API, the adapter's write stays a header copy, and no response carries the Expires: 1970 stamp Jetty adds beside Max-Age. The name is checked against RFC 2616's token rule and the value against RFC 6265's cookie-octet rule at construction, which is the one place a value that would break the header can be refused with a message that names it; anything that is not already an octet, a base64url payload for one, encodes before it gets here.

The attributes are eezo's choice, the one the surveyed frameworks agree on, rather than defaults: every cookie is Path=/, HttpOnly and SameSite=Lax, and lives with the browser session. Only Secure is a parameter, because it is the request's scheme, not the cookie, that knows whether it can be on. Max-Age is set only by Cookie.expired. A custom path, a cookie scripts can read, another SameSite or a lifetime arrive when something needs them, and so does Domain.