Are duplicate cookie names allowed?

[DanKaplanSES]

MDN URL

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cookie

What specific section or headline is this issue about?

No response

What information was incorrect, unhelpful, or incomplete?

I was inspecting a response in my developer tools and I noticed I had sent 2 cookies with the same name to the server. I can't find any information on MDN mention that as a possibility.

What did you expect to see?

I was hoping this page would mention if duplicate cookie names are allowed. It seems my browser allows it, but I don't know if it's following the spec by doing so. I searched the linked spec for dup and didn't find any hits.

Do you have any supporting links, references, or citations?

No response

Do you have anything more you want to share?

No response

MDN metadata

Page report details

• Folder: en-us/web/http/reference/headers/cookie
• MDN URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cookie
• GitHub URL: https://github.com/mdn/content/blob/main/files/en-us/web/http/reference/headers/cookie/index.md
• Last commit: 4d929bb
• Document last modified: 2025-03-13T12:48:23.000Z

[hamishwillee]

Yes. My recollection from documenting the cookie store API (and testing this) is that you can have the same name of cookie at different paths, and also keyed on the partitioned value. So if you set a cookie that is the same name but on a different path you get a new cookie. On the same path and same partitioned value you get an update of the cookie (for value, expires, samesite).

What I'm not sure is whether setting a cookie is schemefully samesite - i.e. you get a different cookie on https vs http sites. I THINK it is.

Yes, we should do a test of this and then make this clear in the HTTP headers doc. We should also make this clear in the top level Cookie_Store_API, CookieStore, CookieStore.set. I thought I had, so this is a timely reminder.
Lastly we should cross link the header to these docs and to Document.cookie.

If no one else does this, I will probably get to it when Firefox releases their version of the Cookie Store in the wild.