这是简单的:

A <cookie-name> can be any US-ASCII characters except control characters (CTLs), spaces, or tabs. It also must not contain a separator character like the following: ( ) < > @ , ; : \ " / [ ] ? = { }. A <cookie-value> can optionally be set in double quotes and any US-ASCII characters excluding CTLs, whitespace, double quotes, comma, semicolon, and backslash are allowed. Encoding: Many implementations perform URL encoding on cookie values, however it is not required per the RFC specification. It does help satisfying the requirements about which characters are allowed for though.

链接:https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie指令

我认为这通常是特定于浏览器的。为了安全起见，base64编码了一个JSON对象，并将所有内容存储在其中。这样你只需要解码和解析JSON。base64中使用的所有字符在大多数浏览器(如果不是所有浏览器)中都可以正常运行。

你不能在cookie的值字段中放入“;”，在大多数浏览器中，将设置的名称是“;”之前的字符串…

One more consideration. I recently implemented a scheme in which some sensitive data posted to a PHP script needed to convert and return it as an encrypted cookie, that used all base64 values I thought were guaranteed 'safe". So I dutifully encrypted the data items using RC4, ran the output through base64_encode, and happily returned the cookie to the site. Testing seemed to go well until a base64 encoded string contained a "+" symbol. The string was written to the page cookie with no trouble. Using the browser diagnostics I could also verify the cookies was written unchanged. Then when a subsequent page called my PHP and obtained the cookie via the $_COOKIE array, I was stammered to find the string was now missing the "+" sign. Every occurrence of that character was replaced with an ASCII space.

考虑到从那时起，我读到过许多类似的未解决的抱怨，描述这种情况，经常使用base64在cookie中“安全地”存储任意数据，我认为我应该指出问题，并提供我公认的笨拙的解决方案。

在你对一段数据做了任何你想做的加密之后，然后使用base64_encode使它“cookie安全”，通过这个运行输出字符串…

// from browser to PHP. substitute troublesome chars with 
// other cookie safe chars, or vis-versa.  

function fix64($inp) {
    $out =$inp;
    for($i = 0; $i < strlen($inp); $i++) {
        $c = $inp[$i];
        switch ($c) {
            case '+':  $c = '*'; break; // definitly won't transfer!
            case '*':  $c = '+'; break;

            case '=':  $c = ':'; break; // = symbol seems like a bad idea
            case ':':  $c = '='; break;

            default: continue;
            }
        $out[$i] = $c;
        }
    return $out;
    }

Here I'm simply substituting "+" (and I decided "=" as well) with other "cookie safe" characters, before returning the encoded value to the page, for use as a cookie. Note that the length of the string being processed doesn't change. When the same (or another page on the site) runs my PHP script again, I'll be able to recover this cookie without missing characters. I just have to remember to pass the cookie back through the same fix64() call I created, and from there I can decode it with the usual base64_decode(), followed by whatever other decryption in your scheme.

我可以在PHP中做一些设置，允许cookie中使用的base64字符串被传输回PHP而不会损坏。与此同时，这是可行的。“+”可能是一个“合法”的cookie值，但如果您希望能够将这样的字符串传输回PHP(在我的例子中是通过$_COOKIE数组)，我建议重新处理以删除违规字符，并在恢复后恢复它们。还有很多其他“饼干安全”的角色可供选择。

cookie规范有两个版本 1. 版本0 cookie，即Netscape cookie， 2. 版本1又名RFC 2965 cookie 在版本0中，cookie的名称和值部分是字符序列，如果不与双引号一起使用，则不包括分号、逗号、等号和空格 版本1要复杂得多，你可以在这里检查 在这个版本中，除了名称不能以$符号开头之外，名称值部分的规格几乎相同

在这里，尽可能简短地说。专注于那些不需要逃跑的角色:

For cookie:

abdefghijklmnqrstuvxyzABDEFGHIJKLMNQRSTUVXYZ0123456789!#$%&'()*+-./:<>?@[]^_`{|}~

为url

abdefghijklmnqrstuvxyzABDEFGHIJKLMNQRSTUVXYZ0123456789.-_~!$&'()*+,;=:@

对于cookie和url(交集)

abdefghijklmnqrstuvxyzABDEFGHIJKLMNQRSTUVXYZ0123456789!$&'()*+-.:@_~

这就是你的回答。

注意，对于cookie， =已被删除，因为它是 通常用于设置cookie值。

对于url this the =被保留。十字路口显然没有。

var chars = "abdefghijklmnqrstuvxyz"; chars += chars.toUpperCase() + "0123456789" + "!$&'()*+-.:@_~";

事实证明，转义仍然会发生，而且还会发生意想不到的情况，特别是在Java cookie环境中，如果遇到最后一个字符，cookie就会用双引号包装。

安全起见，就用A-Za-z1-9。这就是我要做的。