Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cookie explicitly set on the request is getting discarded in favor of the one from the cookie jar #1964

Open
Spikhalskiy opened this issue Jun 17, 2024 · 2 comments · May be fixed by #2033
Open

Comments

@Spikhalskiy
Copy link
Contributor

Spikhalskiy commented Jun 17, 2024

Expected Behavior

A cookie explicitly specified on a RequestBuilder should take precedence over a cookie stored in cookie jar.

Actual Behavior

cookieStore = httpClient.getCookieStore();
cookieStore.add("some_url", new DefaultCookie("name", "value1"));
BoundRequestBuilder requestBuilder = httpClient.prepareGet("some_url");
requestBuilder.addCookie(new DefaultCookie("name", "value2"));
httpClient.executeRequest(requestBuilder.build())

This code leads to a request being performed with cookie "name":"value1", which is not what is expected by a user when a user explicitly sets a cookie on a RequestBuilder.

Root cause

Cookies from cookie jar are overriding cookies coming from the RequestBuilder here

Affected version

2.12.3, 3.0 pre-releases

@pickypg
Copy link

pickypg commented Nov 13, 2024

The supplied link puts the commit hash in the wrong place, but the root cause is that it blindly overrides Cookies by using addOrReplaceCookie(cookie) from the CookieStore, but it should only be using addCookie(cookie), which is even then dangerous if it's duplicating.

https://github.com/AsyncHttpClient/async-http-client/blob/661ec72/client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClient.java#L238

@pickypg
Copy link

pickypg commented Nov 14, 2024

I've added a PR that only uses Cookies from the CookieStore if they're unset.

#2033

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants