Random HTTP Set-Cookie Attribute Corpus Generator

Description

Compose synthetic Set-Cookie name/value pairs and bounded attribute subsets from supplied value pools, including explicit opaque Expires text, flags, and supported name casing; delegate serializer/parser outputs while preserving attribute order, without dates interpreted, browser acceptance, credentials, or security-policy recommendations.

A protocol fixture is local test data representing headers, messages, identifiers, or request decisions. Serialization and parsing can be checked without contacting a server, while authentication, delivery, and actual client behavior require separate tests.

When to use this tool

Use this generator to create reproducible http set cookie attribute corpus cases from the supplied model or bank. Inspect the returned evidence before using cases in a test or exercise.

How to use the tool and how it works

Supply names, values, caseCount, attributePools, minimumAttributes, maximumAttributes, attributeNameCases in the field shapes below. Set seed when you need an explicit replay.
Run the tool and correct any input error. For generated controls, distinguish a successful fixture containing an invalid case from failure to generate the fixture.
Read cases. Use the conventions below and keep answer-bearing fields separate when presenting an exercise.

Draw cookie names, values, and distinct attribute pools, vary attribute-name casing, and delegate Set-Cookie serialization and ordered parsing. Cross-check name/value preservation and normalized lowercase attribute names.^[1]

Delegated operations used for this result: set cookie serializer; set cookie parser. Their calculation or parsing conventions apply to the corresponding result fields.^{[2, 3]}

Input field	Meaning and units	Accepted input
names	Names	Required. Array of Text; minimum UTF-16 length 1; maximum UTF-16 length 32.; minimum items 1; maximum items 16.
values	Values	Required. Array of Text; maximum UTF-16 length 64.; minimum items 1; maximum items 32.
caseCount	Case Count	Required. Safe integer; minimum 1; maximum 32.
attributePools	Attribute Pools	Required. Array of Object; no unknown keys.; maximum items 7.
attributePools[].name	Name	Required. Text; one of "Path", "Domain", "Expires", "Max-Age", "SameSite", "Secure", "HttpOnly".
attributePools[].values	Values	Required. Array of Text; maximum UTF-16 length 64.; minimum items 1; maximum items 8.
minimumAttributes	Minimum Attributes	Required. Safe integer; minimum 0; maximum 7.
maximumAttributes	Maximum Attributes	Required. Safe integer; minimum 0; maximum 7.
attributeNameCases	Attribute Name Cases	Required. Array of Text; one of "original", "lowercase", "uppercase".; minimum items 1; maximum items 3.
seed	Optional numeric seed; takes precedence over context randomness. Without either, use the fixed tool.io default seed.	Optional. Safe integer.

Output field	Interpretation	Returned shape
cases	Cases	Required. Array of Object; no unknown keys.; minimum items 1; maximum items 32.
cases[].cookie	Cookie	Required. Object; no unknown keys.
cases[].cookie.name	Name	Required. Text; minimum UTF-16 length 1; maximum UTF-16 length 32.
cases[].cookie.value	Value	Required. Text; maximum UTF-16 length 64.
cases[].nameCase	Name Case	Required. Text; one of "original", "lowercase", "uppercase".
cases[].attributes	Attributes	Required. Array of Object; no unknown keys.; maximum items 7.
cases[].attributes[].name	Name	Required. Text; minimum UTF-16 length 1; maximum UTF-16 length 16.
cases[].attributes[].value	Value	Required. Text; maximum UTF-16 length 64.
cases[].header	Header	Required. Text; minimum UTF-16 length 2; maximum UTF-16 length 1024.
cases[].parsed	Parsed	Required. Object; no unknown keys.
cases[].parsed.name	Name	Required. Text; minimum UTF-16 length 1; maximum UTF-16 length 32.
cases[].parsed.value	Value	Required. Text; maximum UTF-16 length 64.
cases[].parsed.attributes	Attributes	Required. Array of Object; no unknown keys.; maximum items 7.
cases[].parsed.attributes[].name	Name	Required. Text; minimum UTF-16 length 1; maximum UTF-16 length 16.
cases[].parsed.attributes[].value	Value	Required. Text; maximum UTF-16 length 64.
randomness	Replay metadata: source is seed or context; seed is the normalized 32-bit seed or null for a context source.	Required. Object; no unknown keys.
randomness.seed	Optional numeric replay seed; normalization and precedence are explained below.	Required. Safe integer. or Null.
randomness.source	Source	Required. Text; one of "context", "seed".

An explicit safe-integer seed takes precedence over injected context randomness and is normalized to an unsigned 32-bit integer. With no seed and no context source, replay uses the fixed tool.io default seed. A context source must return finite values from zero inclusive to one exclusive; its advancing state must be retained separately. randomness records the source and normalized seed, or null for context. These generators are not cryptographic random sources.

json

{
  "input": {
    "names": [
      "test"
    ],
    "values": [
      "x",
      "%20"
    ],
    "attributePools": [
      {
        "name": "Path",
        "values": [
          "/"
        ]
      },
      {
        "name": "Expires",
        "values": [
          "Wed, 21 Oct 2037 07:28:00 GMT"
        ]
      },
      {
        "name": "Secure",
        "values": [
          ""
        ]
      }
    ],
    "minimumAttributes": 1,
    "maximumAttributes": 3,
    "attributeNameCases": [
      "original",
      "uppercase"
    ],
    "caseCount": 1,
    "seed": 42
  },
  "output": {
    "cases": [
      {
        "cookie": {
          "name": "test",
          "value": "x"
        },
        "nameCase": "uppercase",
        "attributes": [
          {
            "name": "EXPIRES",
            "value": "Wed, 21 Oct 2037 07:28:00 GMT"
          },
          {
            "name": "PATH",
            "value": "/"
          },
          {
            "name": "SECURE",
            "value": ""
          }
        ],
        "header": "test=x; EXPIRES=Wed, 21 Oct 2037 07:28:00 GMT; PATH=/; SECURE",
        "parsed": {
          "name": "test",
          "value": "x",
          "attributes": [
            {
              "name": "expires",
              "value": "Wed, 21 Oct 2037 07:28:00 GMT"
            },
            {
              "name": "path",
              "value": "/"
            },
            {
              "name": "secure",
              "value": ""
            }
          ]
        }
      }
    ],
    "randomness": {
      "seed": 42,
      "source": "seed"
    }
  }
}

Limitations and assumptions

Secure and HttpOnly are valueless and other selected attributes require values. Syntactic round trips do not establish browser acceptance, secure cookie configuration, expiry interpretation, or actual cookie storage.
A replay requires the same complete input and implementation. Randomized construction does not guarantee uniform coverage of every feasible output; finite samples can repeat unless a distinct-selection rule is explicitly stated.
The field tables state structural bounds; cross-field constraints and bounded search or output budgets also apply. Unknown keys are rejected where the object contract disallows them. Input errors are distinct from null fields and deliberate invalid controls in a successful output.

Alternative or Complementary methods

For a supplied example, inspect the returned construction or delegated check directly. To evaluate a consumer, also test cases chosen for its own boundaries; a generated finite corpus does not establish exhaustive coverage.

References

Tool behavior and example: Random HTTP Set-Cookie Attribute Corpus Generator — tool.io
Calculation or validation: http/set-cookie-serializer — tool.io
Calculation or validation: http/set-cookie-parser — tool.io

Similar or alternative tools

Random HTTP Cookie Round-Trip Corpus Generator
Compose bounded synthetic Cookie pairs from validated name/value fragments, select supported canonical/quoted/compact/spaced formatting, and delegate serialization/parsing while preserving duplicate-name order and encoded values; duplicate constraints are construction rules, not browser conformance, live cookies, or secret generation.
Random HTML Attribute Quoting Corpus Generator
Compose bounded benign start-tag source with caller text, delegated five-character entity escaping, feasible double/single/unquoted/Boolean attribute forms, and duplicate attributes; retain the lexical parser's raw character references and first-duplicate rule, not DOM-decoded values, sanitization, or HTML conformance certification.