Rule for handling UTF-8 characters in cookie for CGI applications?

Question

I was told to always URL-encode a UTF-8 string before placing on a cookie. So when a CGI application reads this cookie, it has to URL-decode the string to get the original UTF-8 string.

Is this the right way to handle UTF-8 characters in cookies?

Is there a better way to do this?

Answer 1

Generally, this is the easiest way, you could do another binary encoding, not sure if base64 includes reserved characters... %uXXXX where XXXX is the hex unicode value is most appropriate.

Answer 2

There is no one standard scheme for encapsulating Unicode characters into a cookie.

URL-encoding the UTF-8 representation is certainly a common and sensible way of doing it, not least because it can be read easily into a Unicode string from JavaScript (using decodeURIComponent). But there's no reason you couldn't choose some other scheme if you prefer.