actix / actix/actix-web

Invalid cookies can be created without error

Open
#3,065 1 comment 0 reactions 0 assignees View on GitHub
A-web C-bug C-bug-upstream
Dominant language
Rust
Stars
24.8k
Forks
1.9k
Avg merge
23h 10m
Merged PRs (30d)
26

Description

[Cookie::set_value](https://docs.rs/actix-web/latest/actix_web/cookie/struct.Cookie.html#method.set_value) accepts any unicode string and never fails, but some unicode strings [are not valid cookie values](https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.1).

Could we add a `try_set_value` method that only accepts valid values ?

Otherwise, we end up with confusing error messages, generated far from where the true source of the error is.

Contributor guide

Open the contributing guide

Research direction

Start with Cookie::set_value in the linked API documentation and compare accepted values with RFC 6265 §4.1.1. Done means a try_set_value entry point rejects invalid cookie values and exposes the failure at the call site, with coverage for accepted and rejected values.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
api, backend
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.