Azure / Azure/azure-functions-host

Proxy merges multiple cookie headers into one

Open
#4,486 16 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
2k
Forks
482
Avg merge
2d 12h
Merged PRs (30d)
38

Description

This makes all modern browsers only capture the first cookie.

#### Investigative information

- Timestamp: Wed, 22 May 2019 14:48:15 GMT
- Function App version (1.0 or 2.0): 2.0
- Region: Westeurope

#### Repro steps

Create function proxy to and endpoint that returns multiple cookies in one response.

#### Expected behavior

The multiple "Set-Cookie" headers should be transported as they are, one-by-one, into the response. example:

`Set-Cookie: idsrv.session=21bxxxxxxxxxxxxxxxxxxxxx93b1; path=/; secure`
`Set-Cookie: .AspNetCore.Identity.Application=CfDJ8EXV_uoT8urq1HrndD5I; expires=Wed, 05 Jun 2019 14:48:15 GMT; path=/; secure; httponly`

#### Actual behavior

However, the function proxy meges the two returned cookies into one comma separated value:

`Set-Cookie: idsrv.session=21bxxxxxxxxxxxxxxxxxxxxx93b1; path=/; secure, .AspNetCore.Identity.Application=CfDJ8EXV_uoT8urq1HrndD5I; expires=Wed, 05 Jun 2019 14:40:59 GMT; path=/; secure; httponly`

This makes it impossible to authenticate via this function proxy.

Contributor guide

Open the contributing guide

Research direction

Start by locating the function proxy response-header handling and trace how multiple Set-Cookie headers are represented and forwarded. Reproduce the proxy response with multiple cookies, then verify that each Set-Cookie header reaches the client separately rather than as one comma-separated value.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp
Domain
api, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.