openedx / openedx/XBlock

Only last cookie is sent to client in response

Open
#523 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
470
Forks
231
Avg merge
1d 1h
Merged PRs (30d)
6

Description

When setting multiple headers with the same name Set-Cookie, only the last one is actually in the django response object.
For instance, this response:

HTTP/2.0 200 OK
Content-Type: text/html
Set-Cookie: yummy_cookie=choco
Set-Cookie: tasty_cookie=strawberry
[page content]

It will only set this Set-Cookie: tasty_cookie=strawberry to response.

A call to django_response.set_cookie() method if the header is "Set-Cookie" might fix it.

https://github.com/edx/XBlock/blob/316cc376945f0c748d4ec7b780ee55bd6aef4425/xblock/django/request.py#L12

https://tools.ietf.org/html/rfc7230

Note: In practice, the "Set-Cookie" header field ([RFC6265]) often
appears multiple times in a response message and does not use the
list syntax, violating the above requirements on multiple header
fields with the same name. Since it cannot be combined into a
single field-value, recipients ought to handle "Set-Cookie" as a
special case while processing header fields. (See Appendix A.2.3
of [Kri2001] for details.)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in xblock/django/request.py at the linked line and inspect how repeated Set-Cookie headers are transferred into the Django response object. Verify the response preserves both cookie values and that the resulting client response contains both Set-Cookie fields; no test file is named in the issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
django, python
Domain
backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.