From 9657b393f22d4f36ce9e4c54a993bc7a657b9955 Mon Sep 17 00:00:00 2001
From: Yarchik <spoko.dev@gmail.com>
Date: Wed, 24 Jun 2026 02:04:46 +0100
Subject: [PATCH] fix: trim whitespace from cookie attribute names and values
 (RFC 6265 5.2)

---
 lib/set-cookie.js         |  4 ++--
 test/set-cookie-parser.js | 30 ++++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/lib/set-cookie.js b/lib/set-cookie.js
index 2c7b9b0..7d4aa62 100644
--- a/lib/set-cookie.js
+++ b/lib/set-cookie.js
@@ -48,11 +48,11 @@ function parseString(setCookieValue, options) {
 
   parts.forEach(function (part) {
     var sides = part.split("=");
-    var key = sides.shift().trimLeft().toLowerCase();
+    var key = sides.shift().trim().toLowerCase();
     if (isForbiddenKey(key)) {
       return;
     }
-    var value = sides.join("=");
+    var value = sides.join("=").trim();
     if (key === "expires") {
       cookie.expires = new Date(value);
     } else if (key === "max-age") {
diff --git a/test/set-cookie-parser.js b/test/set-cookie-parser.js
index 980de6e..6437923 100644
--- a/test/set-cookie-parser.js
+++ b/test/set-cookie-parser.js
@@ -247,6 +247,36 @@ describe("set-cookie-parser", function () {
     assert.deepEqual(actual, expected);
   });
 
+  it("should trim whitespace around attribute names and values (rfc 6265 5.2 step 3)", function () {
+    var actual = parseSetCookie(
+      "foo=bar; Domain= .example.com; Path= /admin; SameSite= Lax"
+    );
+    var expected = [
+      {
+        name: "foo",
+        value: "bar",
+        domain: ".example.com",
+        path: "/admin",
+        sameSite: "Lax",
+      },
+    ];
+    assert.deepEqual(actual, expected);
+
+    actual = parseSetCookie("foo=bar; Domain=.example.com ; Path=/ ");
+    expected = [
+      { name: "foo", value: "bar", domain: ".example.com", path: "/" },
+    ];
+    assert.deepEqual(actual, expected);
+
+    actual = parseSetCookie("foo=bar; Secure ");
+    expected = [{ name: "foo", value: "bar", secure: true }];
+    assert.deepEqual(actual, expected);
+
+    actual = parseSetCookie("foo=bar; Path =/x");
+    expected = [{ name: "foo", value: "bar", path: "/x" }];
+    assert.deepEqual(actual, expected);
+  });
+
   describe("split option", function () {
     const cookieA = "a=b";
     const cookieB = "b=c";