Cookie value set from function is urlencoded
- Dominant language
- No language data
- Stars
- 346
- Forks
- 67
- PR merge metrics
- No merged PRs in 30d
Description
**The cookie value is urlencoded**
When my function tries to return a cookie, its value gets urlencoded, more precisely, it gets urlencoded one more time than `StaticWebAppsAuthCookie` (which also contains special characters).
**To Reproduce**
Steps to reproduce the behavior:
1. Define an API function
2. Have it return
```
{
"status":302,
"headers":{"location":"https://whatever.com/api/other_endpoint"},
"cookies":[
{
"name":"Yadda",
"value":"plus+slash/equals=semicolon;percent%done",
"secure":true,
"httpOnly":true,
"maxAge":28800,
"sameSite":"None"
}
]
}
```
3. Invoke the function with Dev Tools open at the Network tab
4. In the Response headers observe
```
set-cookie: Yadda=plus%2Bslash%2Fequals%3Dsemicolon%3Bpercent%25done; max-age=28800; domain=whatever.com; path=/; secure; samesite=none; httponly
```
5. Observe the the Request headers of the `/api/other_endpoint` request
```
Cookie: AppServiceAuthSession=Ci4...VT/kU/9R...cze+Qm...; StaticWebAppsAuthCookie=Yih/3...jS5++Z14...; Yadda=plus%2Bslash%2Fequals%3Dsemicolon%3Bpercent%25done
```
As you can see, the value of the custom cookie is set and used as a urlencoded string, while the auth cookies (which also contain special characters) aren't. For completeness' sake:
6. Observe the Response headers of `/.auth/complete` of a normal auth workflow:
```
set-cookie: StaticWebAppsAuthCookie=Yih/3/EIo...jS5++Z14Y...uk=; path=/; secure; HttpOnly; domain=whatever.com; expires=Mon, 17 Apr 2023 16:57:28 GMT; SameSite=Strict
```
As you can see, the setting and using of this cookie value is shown as plain text, so even if it's sent with some encoding (surrounding quotes, urlencoded), it's handled transparently by Firefox, so if the custom cookie value is displayed as urlencoded, then it means it's transmitted urlencoded one more time than the auth cookie.
**Expected behavior**
Custom cookies transmitted with the same encoding/wrapping as the auth cookies (as they appear normally for the browser).
**Device info (if applicable):**
- OS: Win11
- Browser: Firefox
- Version: 108
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.