# fix(cookie): relax name validation when parsing Cookie header

2 files changed, +34 −1 in honojs/hono. The author left no usable description, so this brief describes structure only.

| | |
| --- | --- |
| Status | MERGED |
| Source | github:honojs/hono#5164 |
| Original | https://github.com/honojs/hono/pull/5164 |
| Workspace | Showcase |
| Tags | github, code, typescript |

## What it does

**Most of this change is one file: cookie.test.ts holds 74% of the edited lines.**

2 files changed across 2 areas of honojs/hono, 34 added and 1 removed.

The author left no description on this change, so nothing below comes from their account of it.

**Diagram: Where the change landed. Node size is not to scale; the line counts are exact.**

- hono (2 files, 35 lines) [accent]
- Tests (1 file, 26 lines) [good]
- Source (1 file, 9 lines) [accent]
- cookie.test.ts (+26 −0) [bad]
- hono -> Tests
- hono -> Source
- Tests -> cookie.test.ts : heaviest

- **Heaviest file.** src/utils/cookie.test.ts, +26 −0, which is 74% of the change.
- **Tests moved with it.** 1 test file changed alongside 1 source file.
- **Spread.** 2 files, 35 changed lines in total.

## How it works

**The largest single edit is in cookie.test.ts.**

Quoted verbatim from the diff. This is the biggest hunk by changed lines, which is where a reviewer's attention usually belongs first.

**Diagram: Source files matched to test files by filename. A name-based match, so treat it as a prompt to look rather than as proof.**

- NO TEST CHANGED (0)
  - every file paired [good]
- TEST CHANGED TOO (1)
  - cookie.ts (+8 −1) [good]

```typescript
@@ -80,6 +80,32 @@ describe('Parse cookie', () => {
     expect(cookie['']).toBeUndefined()
   })
 
+  it('Should parse cookies whose names are not RFC 6265 tokens', () => {
+    const cookieString =
+      'paraglide:lang=en; CognitoIdentityServiceProvider.abc.user@example.com.idToken=token; round(brackets)=ok; square[brackets]=ok; curly{brackets}=ok'
+    const cookie: Cookie = parse(cookieString)
+    expect(cookie['paraglide:lang']).toBe('en')
+    expect(cookie['CognitoIdentityServiceProvider.abc.user@example.com.idToken']).toBe('token')
+    expect(cookie['round(brackets)']).toBe('ok')
+    expect(cookie['square[brackets]']).toBe('ok')
+    expect(cookie['curly{brackets}']).toBe('ok')
+  })
+
+  it('Should parse one cookie specified by a name that is not an RFC 6265 token', () => {
+    const cookieString = 'paraglide:lang=en; test=ok'
+    const cookie: Cookie = parse(cookieString, 'paraglide:lang')
+    expect(cookie['paraglide:lang']).toBe('en')
+    expect(cookie['test']).toBeUndefined()
+  })
+
```

_src/utils/cookie.test.ts, +26 −0. The largest hunk in the largest file._

## File map

**Every file this change touches, heaviest first.**

Role is inferred from the path and risk from the path and the line count. Neither was read from the code.

| File | Role | Change | Risk |
| --- | --- | --- | --- |
| `src/utils/cookie.test.ts` | test coverage | modified, +26 −0 | low |
| `src/utils/cookie.ts` | application code | modified, +8 −1 | low |

## Receipts

**Where each number above comes from.**

All of it is arithmetic over the file list and the check results, so it can be recomputed from the source.

- **Claim.** 2 files changed, +34 −1.
  - Evidence: src/utils/cookie.test.ts (+26 −0); src/utils/cookie.ts (+8 −1)
  - Where: https://github.com/honojs/hono/pull/5164
- **Claim.** cookie.test.ts carries 74% of the changed lines.
  - Evidence: 26 of 35 changed lines
  - Where: src/utils/cookie.test.ts
- **Claim.** It arrived as 1 commit.
  - Evidence: fix(cookie): relax name validation when parsing Cookie header
  - Where: commit 8a2a955
- **Claim.** CI reports 0 failing of 20.
  - Evidence: codecov/patch
  - Where: CI check: codecov/patch
- **Claim.** The change drew 5 comments.
  - Evidence: ## Bundle size check | | [main](https://github.com/honojs/hono/tree/main) ([26d8e42](https://github.com/honojs/hono/commit/26d8e42bfff7eb78f…
  - Where: comment by github-actions[bot]

## Merge order

**A reading order for the review, not a deployment plan.**

Ordered by how expensive each part is to get wrong, which is a structural property rather than an informed one.

1. **Then cookie.test.ts.** The largest single file in the change, +26 −0.
2. **Finish with the tests.** 1 test file changed. Reading them last tells you what the author believed they were changing.

## What this brief could not check

- No language model read this change. Every statement here is computed from file paths, line counts, and CI status, so it describes the shape of the diff and not what the diff means.