wireshark ,cookie pair

[lyy06301]

If there are multiple '=' in the cookie pair, the value will be truncated by the second '='. Should the complete value be extracted? For example, key1=value_key=value_value; The cookie extracted in ja4h is key1=value_key. Should it be key1=value_key=value_value, where key1 participates in sorting

[john-althouse]

That is correct. JA4H code should treat "x=y=z" as field "x" value "y=z". Does that make sense?