-
Notifications
You must be signed in to change notification settings - Fork 102
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
set-cookie folding #62
Comments
Can you clarify exactly what you're referring to, maybe giving an example of a program that doesn't do what you expect? This library doesn't do anything specific with regard to cookie headers so I just wasn't sure what you're getting at. |
Hi, for example suppose that the server sent the following headers:
Then your library folds the two headers into this one (as returned by the headers property):
Note that I can't simply split the cookies using the comma as separator because I obtains this result
I suppose this is one of the reasons why RFC 6265 advises against the cookie folding. |
I've spent a while looking into this, refreshing my understanding and looking at possible solutions. Here's what I have so far. The behaviour you're observing is coming from
All of these feel problematic to me and will break some existing code, and will also mean downstream code must become more complex. Rather than each header value definitely being a string if it exists, it might also be an array. That means client code would need to check the type or do something like A different option would be to bake cookie handling into this library, or into However, the bigger problem is that none of these will solve the actual problem. RFC 2616 says field-names can appear multiple times if and only if their value is equivalent to a comma-separated list; if a field appears multiple times clients and proxies are allowed to fold them as done here and expect the same result. So what this client is doing is legal, and also it might not even be the one responsible for the folding: the server or a proxy might fold the headers in this way before the client sees them. So the actual problem is that any code parsing a There exist cookie libraries that handle this cleanly, for example the What I recommend you do is use a cookie library instead of parsing these things yourself, and use one that supports multiple field values. |
Here's the issue I've opened: salesforce/tough-cookie#88 |
Just an update that I recently changed the HTTP parser in websocket-driver to use http-parser-js rather than Node's built-in HTTP parser, but the above all holds true. I'd appreciate any feedback that you have. |
salesforce/tough-cookie#88 was closed as wontfix. I was wondering whether you had any feedback on my remarks above, @acarioni? |
The library folds multiple set-cookie headers using commas to separate them, but according to RFC 6265 section 3 this behavior is deprecated.
The text was updated successfully, but these errors were encountered: