Fix Set-Cookie name validation

.changeset/strict-cookie-names.md

@@ -0,0 +1,5 @@
+---
+"effect": patch
+---
+
+Ignore `Set-Cookie` headers whose cookie names do not satisfy the RFC 6265 token syntax.

packages/effect/src/unstable/http/Cookies.ts

@@ -288,7 +288,7 @@ function parseSetCookie(header: string): Cookie | undefined {
     return undefined
   }
   const name = parts[0].slice(0, firstEqual)
-  if (!fieldContentRegExp.test(name)) {
+  if (!cookieNameRegExp.test(name)) {
     return undefined
   }
 

packages/effect/test/unstable/http/Cookies.test.ts

@@ -40,6 +40,18 @@ describe("Cookies", () => {
     })
   })
 
+  describe("fromSetCookie", () => {
+    it("ignores invalid cookie names", () => {
+      const cookies = Cookies.fromSetCookie([
+        "bad name=value",
+        "session=abc"
+      ])
+
+      assertNone(Cookies.get(cookies, "bad name"))
+      assertSome(Cookies.getValue(cookies, "session"), "abc")
+    })
+  })
+
   describe("toSetCookieHeaders", () => {
     const invalidCookie = {
       name: "session",