Azure / Azure/azure-functions-host
Proxy merges multiple cookie headers into one
- Dominant language
- C#
- Stars
- 2k
- Forks
- 482
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 38
Description
This makes all modern browsers only capture the first cookie.
#### Investigative information
- Timestamp: Wed, 22 May 2019 14:48:15 GMT
- Function App version (1.0 or 2.0): 2.0
- Region: Westeurope
#### Repro steps
Create function proxy to and endpoint that returns multiple cookies in one response.
#### Expected behavior
The multiple "Set-Cookie" headers should be transported as they are, one-by-one, into the response. example:
`Set-Cookie: idsrv.session=21bxxxxxxxxxxxxxxxxxxxxx93b1; path=/; secure`
`Set-Cookie: .AspNetCore.Identity.Application=CfDJ8EXV_uoT8urq1HrndD5I; expires=Wed, 05 Jun 2019 14:48:15 GMT; path=/; secure; httponly`
#### Actual behavior
However, the function proxy meges the two returned cookies into one comma separated value:
`Set-Cookie: idsrv.session=21bxxxxxxxxxxxxxxxxxxxxx93b1; path=/; secure, .AspNetCore.Identity.Application=CfDJ8EXV_uoT8urq1HrndD5I; expires=Wed, 05 Jun 2019 14:40:59 GMT; path=/; secure; httponly`
This makes it impossible to authenticate via this function proxy.
Contributor guide
Research direction
Start by locating the function proxy response-header handling and trace how multiple Set-Cookie headers are represented and forwarded. Reproduce the proxy response with multiple cookies, then verify that each Set-Cookie header reaches the client separately rather than as one comma-separated value.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, csharp
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 28/100