For example:
Receive:
Set-Cookie: JSESSIONID=0000j8CydACPu_-J9bE8uTX91YU:12a83ks4k; Path=/

And we have urlencoded session incorrect value:
Cookie: JSESSIONID=0000j8CydACPu_-J9bE8uTX91YU%3A12a83ks4k;

Cookie value can contain ":" and other escaped symbols.

http://www.faqs.org/rfcs/rfc2109.html

http://www.faqs.org/rfcs/rfc2965

General consensus on the web seems to be that v0 cookies do not define any encoding.

Using urlencoding seems to be a popular approach though, supposedly for v1 cookies. That being said in this case the encoding needs to be applied to both the name and the value.

There are however obviously servers that do not support v1 cookies and which will run into issues with urlencoding. For these there should be an option to skip urlencoding entirely.

http://kristol.org/cookie/errata.html

So when sending a cookie, it should only do whatever encoding that was decoded previously. In many cases urlencoding might be a reasonable default, but in many cases it isnt. So I suggest to do the following:

1) also url encode/decode the name by default
2) provide a setRawCookie() method where its up to the user to ensure proper encoding
3) maybe also provide a method to "pass along" a raw cookie in the current request, this method would parse the $_SERVER raw cookie value in a simple a way as possible. Maybe even just pass along the entire cookie in the raw form to prevent any chance of misinterpretation

class My_Zend_Http_Client extends Zend_Http_Client
{
/**

• Add a cookie to the request. If the client has no Cookie Jar, the cookies
• will be added directly to the headers array as "Cookie" headers.
  *
• @param Zend_Http_Cookie|string|bool $cookie
• @param string|null $value If "cookie" is a string, this is the cookie value.
• @return Zend_Http_Client
  */
  public function setCookie($cookie, $value = null)
  {
  if ($cookie !== true) { return parent::setCookie($cookie, $value); }

$this->headers['cookie'] = array('Cookie', $_SERVER['HTTP_COOKIE']);
return $this;
}
}

1. Whatever is received from the server (through Zend_Http_Cookiejar, Zend_Http_Cookie::fromString() etc. is stored and sent back just the way it is

2. Any cookies added manually by the user can be either encoded or not - depending on an additional parameter to Zend_Http_Client->setCookie(). By default it will be true (do encoding) in order to maintain BC.

As a general rule, how does this sound?

$client = new Zend_Http_Client($url, $opts);
$cookie = Zend_Http_Cookie::fromString($_SERVER['HTTP_COOKIE']);
$client->setCookie($cookie);
$response = $client->request();

That seems like a workable approach to me.

It might also make good sense to add an API to quickly do that - but honestly I think this is quite advanced usage so just to save a line of code I think it's not required.

I do not agree that its so advanced. This situation will come up whenever PHP sits as a proxy between a browser and a server, where the server originally set the cookie. In my case its relevant because of a mashup we are doing. The reason why few users get bitten by this issue is that indeed most servers support url encoding. So the scenario is not so obscure, only that it creates problems is. Now if we make this something the user has to do on his own, then you will have all sorts of users fall into this trap over and over again (even if you document this). But if there is a method "passBrowserCookieToServer()", then it will be clear for people that do write a proxy what method they should use to send the cookie to the server.

Thanks for looking into this!