title: Language agnostic cookie encoding / decoding standards
body: <p>I'm having difficulties to figure out what is the standard (or is there any?) for encoding/decoding cookie values regardless to backend platforms.</p>
  
  <p>According to <a href="http://www.ietf.org/rfc/rfc2109.txt">RFC 2109</a>:</p>
  
  <blockquote>
    <p>The VALUE is opaque to the user agent and may be anything the origin server chooses to send, possibly in a server-selected printable ASCII encoding.  "Opaque" implies that the content is of interest and relevance only to the origin server.  The content may, in fact, be readable by anyone that examines the Set-Cookie header.</p>
  </blockquote>
  
  <p>which sounds like "server is the boss" and it decides whatever the encoding will apply. This makes it quite difficult to set a cookie from, say PHP backend and read it from Python or Java or whatever, without writing any manual encode/decode handling on both sides.</p>
  
  <p>Let's say we have a value needs to be encoded. Russian <code>/"печенье (*} значения"/</code> means "cookie value" with some additional non alpha-numeric chars in it. </p>
  
  <p><strong>Python:</strong></p>
  
  <p>Almost every WSGI server does the same and uses Python's <a href="http://docs.python.org/2/library/cookie.html#Cookie.SimpleCookie">SimpleCookie</a> class that encodes to / decodes from <a href="http://hg.python.org/cpython/file/2.7/Lib/Cookie.py#l235">octal literals</a> even though many says that <a href="https://developer.mozilla.org/en-US/docs/JavaScript/Guide/Values,_variables,_and_literals#Integers">octal literals are depreciated</a> in ECMA-262, strict mode. Wtf?</p>
  
  <p>So, our raw cookie value becomes <code>"/\"\320\277\320\265\321\207\320\265\320\275\321\214\320\265 (*} \320\267\320\275\320\260\321\207\320\265\320\275\320\270\321\217\"/"</code></p>
  
  <p><strong>Node.js:</strong></p>
  
  <p>Haven't tested at all but I'm just guessing a JavaScript backend would do it with native <a href="https://developer.mozilla.org/en/docs/JavaScript/Reference/Global_Objects/encodeURIComponent">encodeURIComponent</a> and <a href="https://developer.mozilla.org/en-US/docs/JavaScript/Reference/Global_Objects/decodeURIComponent">decodeURIComponent</a> functions that use <a href="http://mathiasbynens.be/notes/javascript-escapes#hexadecimal">hexadecimal</a> escaping / unescaping?</p>
  
  <p><strong>PHP:</strong></p>
  
  <p>PHP applies <a href="http://php.net/manual/en/function.urlencode.php">urlencode</a> to the cookie values that is similar to <a href="https://developer.mozilla.org/en/docs/JavaScript/Reference/Global_Objects/encodeURIComponent">encodeURIComponent</a> but not exactly the same.</p>
  
  <p>So the raw value becomes; <code>%2F%22%D0%BF%D0%B5%D1%87%D0%B5%D0%BD%D1%8C%D0%B5+%28%2A%7D+%D0%B7%D0%BD%D0%B0%D1%87%D0%B5%D0%BD%D0%B8%D1%8F%22%2F</code> that is not even wrapped with double quotes.</p>
  
  <p>However; if the JavaScript <code>value</code> variable has the PHP encoded value above, <code>decodeURIComponent(value)</code> gives <code>/"печенье+(*}+значения"/</code>, see "+" chars instead of spaces..</p>
  
  <p><strong>What is the situation in Java, Ruby, Perl and .NET?</strong> Which language is following (or closest) to the desired behaviour. Actually, is there any standard for this defined by W3?</p>