RFC 6265: HTTP cookie

11. If the cookie store contains a cookie with the same name,
domain, and path as the newly created cookie:

1. Let old-cookie be the existing cookie with the same name,
domain, and path as the newly created cookie. (Notice that
this algorithm maintains the invariant that there is at most
one such cookie.)

2. If the newly created cookie was received from a “non-HTTP”
API and the old-cookie’s http-only-flag is set, abort these
steps and ignore the newly created cookie entirely.

3. Update the creation-time of the newly created cookie to
match the creation-time of the old-cookie.

4. Remove the old-cookie from the cookie store.

When the user agent receives a Set-Cookie header, the user agent
stores the cookie together with its attributes. Subsequently, when
the user agent makes an HTTP request, the user agent includes the
applicable, non-expired cookies in the Cookie header.

If the user agent receives a new cookie with the same cookie-name,
domain-value, and path-value as a cookie that it has already stored,
the existing cookie is evicted and replaced with the new cookie.
Notice that servers can delete cookies by sending the user agent a
new cookie with an Expires attribute with a value in the past.

Finally, to remove a cookie, the server returns a Set-Cookie header
with an expiration date in the past. The server will be successful
in removing the cookie only if the Path and the Domain attribute in
the Set-Cookie header match the values used when the cookie was
created.

Notice that servers can delete cookies by sending the user agent a
new cookie with an Expires attribute with a value in the past.

A cookie is “expired” if the cookie has an expiry date in the past.

The user agent MUST evict all expired cookies from the cookie store
if, at any time, an expired cookie exists in the cookie store.

At any time, the user agent MAY “remove excess cookies” from the
cookie store if the number of cookies sharing a domain field exceeds
some implementation-defined upper bound (such as 50 cookies).

At any time, the user agent MAY “remove excess cookies” from the
cookie store if the cookie store exceeds some predetermined upper
bound (such as 3000 cookies).

When the user agent removes excess cookies from the cookie store, the
user agent MUST evict cookies in the following priority order:

1. Expired cookies.

2. Cookies that share a domain field with more than a predetermined
number of other cookies.

3. All cookies.

If two cookies have the same removal priority, the user agent MUST
evict the cookie with the earliest last-access date first.

When “the current session is over” (as defined by the user agent),
the user agent MUST remove from the cookie store all cookies with the
persistent-flag set to false.

Origin servers SHOULD NOT fold multiple Set-Cookie header fields into
a single header field. The usual mechanism for folding HTTP headers
fields (i.e., as defined in [RFC2616]) might change the semantics of
the Set-Cookie header field because the %x2C (“,”) character is used
by Set-Cookie in a way that conflicts with such folding.

== Server -> User Agent ==

Set-Cookie: SID=31d4d96e407aad42; Path=/; Secure; HttpOnly
Set-Cookie: lang=en-US; Path=/; Domain=example.com

== User Agent -> Server ==

Cookie: SID=31d4d96e407aad42; lang=en-US

Although cookies are serialized linearly in the Cookie header,
servers SHOULD NOT rely upon the serialization order. In particular,
if the Cookie header contains two cookies with the same name (e.g.,
that were set with different Path or Domain attributes), servers
SHOULD NOT rely upon the order in which these cookies appear in the
header.

set-cookie-header = “Set-Cookie:” SP set-cookie-string
set-cookie-string = cookie-pair *( “;” SP cookie-av )
cookie-pair = cookie-name “=” cookie-value
cookie-name = token
cookie-value = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
; US-ASCII characters excluding CTLs,
; whitespace DQUOTE, comma, semicolon,
; and backslash
token = <token, defined in [RFC2616], Section 2.2>

token = 1*<any CHAR except CTLs or separators>
separators = “(” | “)” | “<” | “>” | “@”
| “,” | “;” | “:” | “\” | <“>
| “/” | “[” | “]” | “?” | “=”
| “{” | “}” | SP | HT