Cookie

Build a Set-Cookie header with Cookie->new, then reload to see it parsed back out of the jar with Cookie->read.

(no demo cookies set yet)

Try to break it

The value is URL-encoded over UTF-8 octets, so separators and CR/LF cannot escape into the header. Paste a newline or a ; into the value and watch what comes out. Names are validated as RFC 6265 tokens, so bad name or a=b is refused outright. The __Host- prefix forces Secure, Path=/ and no Domain — name one __Host-demo and see.

Only cookies beginning demo_ are shown or removed here, so this page cannot touch your admin session or Tally's visitor id.