All input data goes through some minor modifications for both standardization and security.  In this case, tabs are converted in ExpressionEngine 1.x to 4 space characters for a specific issue encountered years ago, and this has continued for legacy support reasons.  2.0 will be the earliest break from this behavior, but a simple hack to core.input.php at the top of the file that will be safe and easy to maintain is to change:

to

And ExpressionEngine will no longer trim whitespace from your input data nor convert tabs to spaces.

I set $trim_input = FALSE inside of core.input.php.  Deleted all my cookies.

Set the cookie and read it from inside EE.

The cookie is still being modified by EE.

Check and make sure your core.input.php file is not being cached by a server mechanism such as eAccelerator.  You can generally force a refresh in these instances by introducing a syntax error, accessing the site, and then correcting the error.  That is where the tab (ASCII 9) is being converted to four spaces (ASCII 32).

I can confirm that setting $trim_input to FALSE doesn’t solve the issue I’m having and that it’s not a matter of caching.  (Just to be absolutely certain, I tried it on a second machine that never had EE installed.)

Strangely enough, if I comment out this code in core.input.php:

if ($this->trim_input == TRUE)
{
$str = str_replace("\t", ‘ ‘, $str);
$str = trim($str);
}

Then my cookie is unchanged.  I don’t know this piece of code is ignoring the $this->trim_input flag, but it is.

Figured it out.

This line in core.system.php which appears right after core.input.php is substantiated was overriding the $trim_input flag that’s set in the class.

$IN->trim_input = (isset($uri)) ? TRUE : FALSE;

That still didn’t correct the problem.  It stopped inserting the four spaces, but it replaced the tab with a single space.

I had to comment out this section of core.input.php to get some relief

/** -----------------------------------
/** Fetch and pre-process COOKIE data
/** -----------------------------------*/

if (is_array($_COOKIE) AND count($_COOKIE) > 0)
{
foreach($_COOKIE as $key => $val)
{
$_COOKIE[$this->clean_input_keys($key)] = $REGX->xss_clean($this->clean_input_data($val));
}
}

Ah yes, indeed.  Though you could also in fetch_input_data() set that class property to FALSE just for the $_COOKIE scrubbing, and reset it to its previous value afterward.  You’ll still want the keys cleaned and the data run through the XSS filter, afterall.