eclipse-ee4j / eclipse-ee4j/jersey

Jersey CookieProvider breaks spec when building Cookie header for multiple cookies

Open
#5,179 0 comments 1 reaction 0 assignees View on GitHub
triage needed
Dominant language
Java
Stars
730
Forks
382
PR merge metrics
No merged PRs in 30d

Description

Jersey client is RFC2109-compliant when only a single Cookie is being transformed into a `Cookie` header. However, if there are multiple cookies being sent in a single request, the generated header is NOT RFC2109 compliant.

[RFC2109's spec for generating the Cookie header](https://www.rfc-editor.org/rfc/rfc2109#section-4.3.4) states:

>```
> cookie = "Cookie:" cookie-version
> 1*((";" | ",") cookie-value)
> cookie-value = NAME "=" VALUE [";" path] [";" domain]
> cookie-version = "$Version" "=" value
> NAME = attr
> VALUE = value
> path = "$Path" "=" value
> domain = "$Domain" "=" value
>```

This means that there should only be one `$Version=X` in the Cookie header. However, if multiple Cookies are in a request, the Cookie header has a `$Version` for each cookie.

Example:

Say there are two cookies, A & B.

```
Cookie A:
Version=1
NAME=A
VALUE=1
---
Cookie B:
Version=1
Name=B
VALUE=2
```

The `Cookie` header generated for Cookie A alone is: `$Version=1; A=1`, which is spec compliant. However, for both A & B, the `Cookie` header generated is `$Version=1; A=1, $Version=1; B=2`. This is not RFC2019 compliant. The compliant header would be `$Version=1; A=1, B=2`. The basic root cause is the [CookieProvider](https://github.com/eclipse-ee4j/jersey/blob/master/core-common/src/main/java/org/glassfish/jersey/message/internal/CookieProvider.java#L43-L63) creates a string for each cookie starting with `$Version=X`.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.