JDK-8286454 : Upgrade Cookie handling classes in java.net package to conform with RFC 6265
  • Type: Enhancement
  • Component: core-libs
  • Sub-Component: java.net
  • Affected Version: 17
  • Priority: P4
  • Status: Open
  • Resolution: Unresolved
  • OS: generic
  • CPU: generic
  • Submitted: 2022-05-09
  • Updated: 2025-10-08
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
Other
tbdUnresolved
Related Reports
Relates :  
JDK-8206092 - HttpCookie.domainMatches() does not match to sub-sub-domain
Relates :  
JDK-8351983 - HttpCookie Parser Incorrectly Handles Cookies with Expires Attribute
Description
ADDITIONAL SYSTEM INFORMATION :
Windows 10
Java 17

A DESCRIPTION OF THE PROBLEM :
According to RFC 6265 

"this document requests the following actions:

   1.  Change the status of [RFC2109] to Historic (it has already been
       obsoleted by [RFC2965]).

   2.  Change the status of [RFC2965] to Historic.

   3.  Indicate that [RFC2965] has been obsoleted by this document.

   In particular, in moving RFC 2965 to Historic and obsoleting it, this
   document deprecates the use of the Cookie2 and Set-Cookie2 header
   fields."

Hence classes which depends on RFC 2965 & RFC 2109 

1) HttpCookie [https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/net/HttpCookie.html]

2) CookiePolicy [https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/net/CookiePolicy.html]

Must be updated to conform with RFC 6265 [https://www.rfc-editor.org/rfc/rfc6265]
Comments
One difference is that "Set-Cookie2" and "Cookie2" headers are deprecated for "Set-Cookie" and "Cookie" but we already don't generate the "*Cookie2" variants internally, but we'd probably still have to support them. I'm sceptical of reports that don't contain specific problems to be solved, and just have vague editorial style requests. To claim support for 6265 and update the docs, I think we would have to do quite a bit of work to determine if we already support it or what work would be required to do so. I don't see it as a priority unless someone complains about a specific point that we don't support.
10-05-2022
Moved to JDK for further discussions.
10-05-2022