eclipse-ee4j / eclipse-ee4j/jersey
Jersey CookieProvider breaks spec when building Cookie header for multiple cookies
- Dominant language
- Java
- Stars
- 730
- Forks
- 382
- PR merge metrics
- No merged PRs in 30d
Description
Jersey client is RFC2109-compliant when only a single Cookie is being transformed into a `Cookie` header. However, if there are multiple cookies being sent in a single request, the generated header is NOT RFC2109 compliant.
[RFC2109's spec for generating the Cookie header](https://www.rfc-editor.org/rfc/rfc2109#section-4.3.4) states:
>```
> cookie = "Cookie:" cookie-version
> 1*((";" | ",") cookie-value)
> cookie-value = NAME "=" VALUE [";" path] [";" domain]
> cookie-version = "$Version" "=" value
> NAME = attr
> VALUE = value
> path = "$Path" "=" value
> domain = "$Domain" "=" value
>```
This means that there should only be one `$Version=X` in the Cookie header. However, if multiple Cookies are in a request, the Cookie header has a `$Version` for each cookie.
Example:
Say there are two cookies, A & B.
```
Cookie A:
Version=1
NAME=A
VALUE=1
---
Cookie B:
Version=1
Name=B
VALUE=2
```
The `Cookie` header generated for Cookie A alone is: `$Version=1; A=1`, which is spec compliant. However, for both A & B, the `Cookie` header generated is `$Version=1; A=1, $Version=1; B=2`. This is not RFC2019 compliant. The compliant header would be `$Version=1; A=1, B=2`. The basic root cause is the [CookieProvider](https://github.com/eclipse-ee4j/jersey/blob/master/core-common/src/main/java/org/glassfish/jersey/message/internal/CookieProvider.java#L43-L63) creates a string for each cookie starting with `$Version=X`.
Contributor guide
Assessment
This issue has not been assessed yet.