The server generally sets these, but if both the server and the client modifies the values then it becomes a global shared mutable state across systems.
This feels bad.
In the RFC it does not mention user agents modifying cookies other than by predefined rules (e.g. Honoring cookie expiry). It also says in the summary about cookies:
… These header fields can be used by HTTP servers to store state at HTTP user agents
However it does not actually prohibit or explicitly advise against clients modifying cookies.
- Is it acceptable to modify cookies on a user agent?
- Are there any references or guidelines on this matter?