Oh and this is where Neon merges (concatenates) the values of headers with same name: https://github.com/notroj/neon/blob/f52d2c9d1fd3bb9527562930856e4d1de91f2267/src/ne_request.c#L1155

Well, the problem lays in the way Neon stores the headers.
Whether we use X or Y, the problem is the same.

Unfortunately, if in the HTTP response there are several headers with the same name, Neon will merge them like if there was only one header in the HTTP response. How it merges the value of all headers with the same? It concatenates the value and uses ", " as a separators between header values.

This is quite problematic because the string ", " is sometimes contained in the value of a "Set-Cookie" header.
Indeed, cookies have expiration date usually, so it's very common that the value of a "Set-Cookie" header contains for example: "expires=Fri, 31-Dec-2100 23:59:59 GMT".

In the end, once Neon gives us the value of the merged "Set-Cookie" header, there's easy no way to distinguished between Neon's header values separator and the separator between the weekday and day of month. They are the same separator : ", ".

The best would be an API change in Neon of course. But as a quicker workaround, we could imagine checking the grammar of that merged "Set-Cookie" value to be able to understand when a cookie parameter starts and where it finishes.