Have #'parse-set-cookie-header parse concatenated Set-Cookie values

[vlnx]

Have #'parse-set-cookie-header parse concatenated Set-Cookie values

[fukamachi]

cl-cookie doesn't support concatenated Set-Cookie header (at least) now because it can cause issues regardless of what the spec says.
The main issue is commonly Set-Cookie header contains "," in its Expires value without double-quotes.

name=value; domain=example.com; path=/; expires=Wed, 16 Jul 2015 07:05:14 +0900

I don't think the behavior does matter since many browsers also ignore it except the first one. You can check how your browser treats it with the following code.

(ql:quickload '(:clack :lack :lack-request))

(clack:clackup (lambda (env)
                          (let ((req (lack.request:make-request env)))
                            `(200
                              (:set-cookie "name1=value; path=/; Expires=Wed, 16 Jul 2015 07:05:14 +0900; HttpOnly, name2=value; HttpOnly")
                              (,(prin1-to-string (lack.request:request-cookies req)))))))

It seems Safari parses the both cookies, however Firefox and Chromium parse only name1.