Set-Cookie header is set in response when valid cookies are sent in headers

Open
#52 5 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
ruby
Domain
backend

Research direction

Start in lib/rack/session/abstract/id.rb at set_cookie and lib/rack/session/cookie.rb at encode_session_data. Compare how Rack 2.x and Rack 3.x handle an unchanged session when encryption adds a random IV, then inspect the existing session tests for Set-Cookie behavior. Done means the expected Rack 3.x behavior is established and covered by a regression test or clearly documented.

Written by the indexing model from the issue text.

Description

Currently, when setting up a rack app using Cookie session, I encounter the following behavior:

  • Step 1: I send the first request without any cookies. I receive a response with Set-Cookie header.
  • Step 2: I send the second request with Cookie header equal to the above Set-Cookie header

In Rack 2.x: Set-Cookie is not set in the response
In Rack 3.x: Set-Cookie header is set

I checked and saw that in lib/rack/session/abstract/id.rb, set_cookie method compares new cookie value with existing one to decide whether to set Set-Cookie header. However, in lib/rack/session/cookie.rb, when encode_session_data, the encryptor injects a random IV, so cookie value is always different, even though the session value is the same.

I check RFC 6265 and it states that

If a server sends multiple responses containing Set-Cookie headers concurrently to the user agent (e.g., when communicating with the user agent over multiple sockets), these responses create a "race condition" that can lead to unpredictable behavior.

Can I confirm whether it's expected that Rack 3.x changes the behavior here?

Dominant language
Ruby
Stars
52
Forks
22
Avg merge
2d 22h
Merged PRs (30d)
1

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from rack/rack-session

All issues in rack/rack-session

Similar issues

More Ruby issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.