Zabbix uses a comma to join multiple same header fields. However for cookies, this results in corrupted cookies. Cookie headers should be joined with a semicolon, as specified by the spec (RFC 6265).

Steps to reproduce:

1. Setup web performance check.
2. The server should return a cookie header `Set-Cookie: A=B` in step 1.
3. Step 2 should send a cookie header `Cookie: C=D`.
4. Inspect the actual request sent by Zabbix in step 2.

Result:

The request specifies the headers as follows:

Cookie: A=B, C=D

This is parsed by some servers (e.g. ASP.NET) as a cookie with name "A" and value "B, C=D". 

Expected:

Cookie: A=B; C=D

This will be parsed by all RFC6265 compliant servers as two cookies; "A" with value "B" and "C" with value "D".

Background:

Note that the comma was a valid separator when the web was using "Netscape compliant cookies", especially RFC2109. However that RFC has been superseded by RFC 6265, and that only lists the semicolon as a valid separator:

4.2.1. Syntax

The user agent sends stored cookies to the origin server in the Cookie header. If the server conforms to the requirements in Section 4.1 (and the user agent conforms to the requirements in Section 5), the user agent will send a Cookie header that conforms to the following grammar:

cookie-header = "Cookie:" OWS cookie-string OWS
cookie-string = cookie-pair *( ";" SP cookie-pair )

Multiple cookies returned from the server will correctly be joined by a semicolon. However when a custom header cookie is specified, it will be appended to the server-specified cookies and separated by a comma. As a result of this, the last cookie returned by the server will be corrupted.