Azure / Azure/static-web-apps

Cookie value set from function is urlencoded

Open
#1,140 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
346
Forks
67
PR merge metrics
No merged PRs in 30d

Description

**The cookie value is urlencoded**

When my function tries to return a cookie, its value gets urlencoded, more precisely, it gets urlencoded one more time than `StaticWebAppsAuthCookie` (which also contains special characters).

**To Reproduce**
Steps to reproduce the behavior:
1. Define an API function
2. Have it return
```
{
"status":302,
"headers":{"location":"https://whatever.com/api/other_endpoint"},
"cookies":[
{
"name":"Yadda",
"value":"plus+slash/equals=semicolon;percent%done",
"secure":true,
"httpOnly":true,
"maxAge":28800,
"sameSite":"None"
}
]
}
```
3. Invoke the function with Dev Tools open at the Network tab
4. In the Response headers observe
```
set-cookie: Yadda=plus%2Bslash%2Fequals%3Dsemicolon%3Bpercent%25done; max-age=28800; domain=whatever.com; path=/; secure; samesite=none; httponly
```
5. Observe the the Request headers of the `/api/other_endpoint` request
```
Cookie: AppServiceAuthSession=Ci4...VT/kU/9R...cze+Qm...; StaticWebAppsAuthCookie=Yih/3...jS5++Z14...; Yadda=plus%2Bslash%2Fequals%3Dsemicolon%3Bpercent%25done
```

As you can see, the value of the custom cookie is set and used as a urlencoded string, while the auth cookies (which also contain special characters) aren't. For completeness' sake:

6. Observe the Response headers of `/.auth/complete` of a normal auth workflow:
```
set-cookie: StaticWebAppsAuthCookie=Yih/3/EIo...jS5++Z14Y...uk=; path=/; secure; HttpOnly; domain=whatever.com; expires=Mon, 17 Apr 2023 16:57:28 GMT; SameSite=Strict
```

As you can see, the setting and using of this cookie value is shown as plain text, so even if it's sent with some encoding (surrounding quotes, urlencoded), it's handled transparently by Firefox, so if the custom cookie value is displayed as urlencoded, then it means it's transmitted urlencoded one more time than the auth cookie.

**Expected behavior**
Custom cookies transmitted with the same encoding/wrapping as the auth cookies (as they appear normally for the browser).

**Device info (if applicable):**
- OS: Win11
- Browser: Firefox
- Version: 108

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.