Only last cookie is sent to client in response
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 470
- Forks
- 231
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 6
Description
When setting multiple headers with the same name Set-Cookie, only the last one is actually in the django response object.
For instance, this response:
HTTP/2.0 200 OK
Content-Type: text/html
Set-Cookie: yummy_cookie=choco
Set-Cookie: tasty_cookie=strawberry
[page content]
It will only set this Set-Cookie: tasty_cookie=strawberry to response.
A call to django_response.set_cookie() method if the header is "Set-Cookie" might fix it.
https://tools.ietf.org/html/rfc7230
Note: In practice, the "Set-Cookie" header field ([RFC6265]) often
appears multiple times in a response message and does not use the
list syntax, violating the above requirements on multiple header
fields with the same name. Since it cannot be combined into a
single field-value, recipients ought to handle "Set-Cookie" as a
special case while processing header fields. (See Appendix A.2.3
of [Kri2001] for details.)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in xblock/django/request.py at the linked line and inspect how repeated Set-Cookie headers are transferred into the Django response object. Verify the response preserves both cookie values and that the resulting client response contains both Set-Cookie fields; no test file is named in the issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- django, python
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100