Difference between set-cookie2 and set-cookie

Question

Is there any advantage of using set-cookie2 over set-cookie. And is there any difference in how they affect the functionality on server and client side.

Groin

Answer 1

Set-Cookie2 isn't widely implemented and now deprecated.

See RFC 6265.

Francoise

Does not answer the question. – Proser

Answer 2

First of all Set-Cookie2 is deprecated as of RFC6265 and should not be used. But as for the differences between Set-Cookie and Set-Cookie2:

Set-Cookie2 allowed you to restrict your cookie to a list of ports to which the cookie may be sent. According to RFC2965:

The Port attribute restricts the port to which a cookie may be returned in a Cookie request header. Note that the syntax REQUIREs quotes around the OPTIONAL portlist even if there is only one portnum in portlist.

There are three possible behaviors, depending on the Port attribute in the Set-Cookie2 response header:

1. By default (no Port attribute), the cookie MAY be sent to any port.

2. If the attribute is present but has no value (e.g., Port), the cookie MUST only be sent to the request-port it was received from.

3. If the attribute has a port-list, the cookie MUST only be returned if the new request-port is one of those listed in port-list.

This differs because Set-Cookie does not allow you to restrict cookies to any specific ports. Therefore your cookies are sent to any port on that host no matter the port number.

Ultimately