apache / apache/jmeter

HTTP Cookie Manager not deleting cookie if Set-Cookie is sent with Comment or Max-Age attribute

Open
#6,051 0 comments 0 reactions 0 assignees View on GitHub
defect to-triage
Dominant language
Java
Stars
9.5k
Forks
2.3k
Avg merge
1d 22h
Merged PRs (30d)
5

Description

### Expected behavior

JMeter HTTP Cookie Manager should delete a cookie even if a `Comment` attribute is present in the "cookie-deleting" (typically via the attribute `Max-Age: 0`) `Set-Cookie` header.

This request is supported by the fact that both Firefox and Chrome do so. Also, the [RFC](https://www.ietf.org/rfc/rfc6265.txt) seems to be clear about this:

> ...
> 6. Process the attribute-name and attribute-value according to the
> requirements in the following subsections. (Notice that
> attributes with unrecognized attribute-names are ignored.)

UPDATE: The manager seems to have the very same problem also when `Max-Age: 0` attribute (as the more recent replacement for the `Expires` attribute) is present.

### Actual behavior

Cookie is still sent on follow-up requests, although it should have been deleted.

### Steps to reproduce the problem

1. Add "HTTP Cookie Manager" to a JMeter test. Leave Cookie Policy combobox set to the default value: "standard".
3. Use a "HTTP Request" sampler to call a service returning a cookie (e.g. named `TGC`).
3. Use a "HTTP Request" sampler to call a service which returns a cookie-deleting "Set-Cookie" header (e.g. `Set-Cookie: TGC=ABCD; Version=1; Comment="Logging you out"; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/`).
4. Use a "HTTP Request" sampler to call another service on the same site.
5. After running the test, check whether cookie was still sent by JMeter in the last HTTP request.

### Workaround

a) Set the Cookie Policy to "compatibility" (some other values might it fix as well - not tested though). Then the cookie gets correctly removed, but this policy has some other disadvantages - unwanted side effects.
b) Set the cookie value to an empty string (e.g .`Set-Cookie: TGC=""; ...` in the example above).

### JMeter Version

5.5, 5.6.2

### Java Version

not relevant

### OS Version

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.