Random HTTP Cookie Round-Trip Corpus Generator

Description

Compose bounded synthetic Cookie pairs from validated name/value fragments, select supported canonical/quoted/compact/spaced formatting, and delegate serialization/parsing while preserving duplicate-name order and encoded values; duplicate constraints are construction rules, not browser conformance, live cookies, or secret generation.

A protocol fixture is local test data representing headers, messages, identifiers, or request decisions. Serialization and parsing can be checked without contacting a server, while authentication, delivery, and actual client behavior require separate tests.

When to use this tool

Use this generator to create reproducible http cookie round trip corpus cases from the supplied model or bank. Inspect the returned evidence before using cases in a test or exercise.

How to use the tool and how it works

Supply names, values, caseCount, pairsPerHeader, duplicateNames, formats in the field shapes below. Set seed when you need an explicit replay.
Run the tool and correct any input error. For generated controls, distinguish a successful fixture containing an invalid case from failure to generate the fixture.
Read cases. Use the conventions below and keep answer-bearing fields separate when presenting an exercise.

Generate Cookie pairs under allow, forbid, or force duplicate-name policy. Serialize canonically, render a selected quoting/spacing variant, and delegate parsing to verify ordered pair preservation and report duplicate names.^[1]

Delegated operations used for this result: cookie serializer; cookie parser. Their calculation or parsing conventions apply to the corresponding result fields.^{[2, 3]}

Input field	Meaning and units	Accepted input
names	Names	Required. Array of Text; minimum UTF-16 length 1; maximum UTF-16 length 32.; minimum items 1; maximum items 16.
values	Values	Required. Array of Text; maximum UTF-16 length 64.; minimum items 1; maximum items 32.
caseCount	Case Count	Required. Safe integer; minimum 1; maximum 32.
pairsPerHeader	Pairs Per Header	Required. Safe integer; minimum 0; maximum 16.
duplicateNames	Duplicate Names	Required. Text; one of "allow", "force", "forbid".
formats	Formats	Required. Array of Text; one of "canonical", "quoted", "compact", "spaced".; minimum items 1; maximum items 4.
seed	Optional numeric seed; takes precedence over context randomness. Without either, use the fixed tool.io default seed.	Optional. Safe integer.

Output field	Interpretation	Returned shape
cases	Cases	Required. Array of Object; no unknown keys.; minimum items 1; maximum items 32.
cases[].format	Format	Required. Text; one of "canonical", "quoted", "compact", "spaced".
cases[].canonicalHeader	Canonical Header	Required. Text; maximum UTF-16 length 2048.
cases[].header	Header	Required. Text; maximum UTF-16 length 2048.
cases[].pairs	Pairs	Required. Array of Object; no unknown keys.; maximum items 16.
cases[].pairs[].name	Name	Required. Text; minimum UTF-16 length 1; maximum UTF-16 length 32.
cases[].pairs[].value	Value	Required. Text; maximum UTF-16 length 64.
cases[].parsed	Parsed	Required. Array of Object; no unknown keys.; maximum items 16.
cases[].parsed[].name	Name	Required. Text; minimum UTF-16 length 1; maximum UTF-16 length 32.
cases[].parsed[].value	Value	Required. Text; maximum UTF-16 length 64.
cases[].duplicateNames	Duplicate Names	Required. Array of Text; minimum UTF-16 length 1; maximum UTF-16 length 32.; maximum items 8.
randomness	Replay metadata: source is seed or context; seed is the normalized 32-bit seed or null for a context source.	Required. Object; no unknown keys.
randomness.seed	Optional numeric replay seed; normalization and precedence are explained below.	Required. Safe integer. or Null.
randomness.source	Source	Required. Text; one of "context", "seed".

An explicit safe-integer seed takes precedence over injected context randomness and is normalized to an unsigned 32-bit integer. With no seed and no context source, replay uses the fixed tool.io default seed. A context source must return finite values from zero inclusive to one exclusive; its advancing state must be retained separately. randomness records the source and normalized seed, or null for context. These generators are not cryptographic random sources.

json

{
  "input": {
    "names": [
      "a",
      "b"
    ],
    "values": [
      "x",
      "%20",
      ""
    ],
    "caseCount": 2,
    "pairsPerHeader": 3,
    "duplicateNames": "force",
    "formats": [
      "canonical",
      "quoted",
      "compact",
      "spaced"
    ],
    "seed": 42
  },
  "output": {
    "cases": [
      {
        "format": "compact",
        "canonicalHeader": "a=%20; b=x; a=%20",
        "header": "a=%20;b=x;a=%20",
        "pairs": [
          {
            "name": "a",
            "value": "%20"
          },
          {
            "name": "b",
            "value": "x"
          },
          {
            "name": "a",
            "value": "%20"
          }
        ],
        "parsed": [
          {
            "name": "a",
            "value": "%20"
          },
          {
            "name": "b",
            "value": "x"
          },
          {
            "name": "a",
            "value": "%20"
          }
        ],
        "duplicateNames": [
          "a"
        ]
      },
      {
        "format": "spaced",
        "canonicalHeader": "a=x; a=x; a=%20",
        "header": " a = x ; a = x ; a = %20 ",
        "pairs": [
          {
            "name": "a",
            "value": "x"
          },
          {
            "name": "a",
            "value": "x"
          },
          {
            "name": "a",
            "value": "%20"
          }
        ],
        "parsed": [
          {
            "name": "a",
            "value": "x"
          },
          {
            "name": "a",
            "value": "x"
          },
          {
            "name": "a",
            "value": "%20"
          }
        ],
        "duplicateNames": [
          "a"
        ]
      }
    ],
    "randomness": {
      "seed": 42,
      "source": "seed"
    }
  }
}

Limitations and assumptions

Force needs at least two pairs and forbid needs enough names. Repeated cookie names remain separate pairs; the generator does not decide application first/last precedence or browser storage semantics.
A replay requires the same complete input and implementation. Randomized construction does not guarantee uniform coverage of every feasible output; finite samples can repeat unless a distinct-selection rule is explicitly stated.
The field tables state structural bounds; cross-field constraints and bounded search or output budgets also apply. Unknown keys are rejected where the object contract disallows them. Input errors are distinct from null fields and deliberate invalid controls in a successful output.

Alternative or Complementary methods

For a supplied example, inspect the returned construction or delegated check directly. To evaluate a consumer, also test cases chosen for its own boundaries; a generated finite corpus does not establish exhaustive coverage.

References

Tool behavior and example: Random HTTP Cookie Round-Trip Corpus Generator — tool.io
Calculation or validation: http/cookie-serializer — tool.io
Calculation or validation: http/cookie-parser — tool.io

Similar or alternative tools

Random HTTP Set-Cookie Attribute Corpus Generator
Compose synthetic Set-Cookie name/value pairs and bounded attribute subsets from supplied value pools, including explicit opaque Expires text, flags, and supported name casing; delegate serializer/parser outputs while preserving attribute order, without dates interpreted, browser acceptance, credentials, or security-policy recommendations.
Random UPC Compression Round-Trip Corpus Generator
Construct synthetic UPC-A cases from four disjoint zero-suppression families plus guaranteed noncompressible controls, delegate check digits and both conversions, and return observed round trips; prefixes must fit every requested family, cases may repeat, and no product allocation is implied.