Cookies don't seem to get picked up within a chain or redirect requests

[mdirkse]

Hi,

I'm using ureq in a project to do ADFS authentication for AWS. The login mechanics basically work like this:

1. GET the login page, which will set an auth-request cookie
2. POST post credentials (along with the auth-request cookie)
3. If the credentials are valid the server responds with a 302 to the same login page and an auth-response cookie
4. The client then GETs the redirect URL with the auth request and response cookie, to which the server replies with an HTML page that includes a form with SAML assertion that can be used to login to AWS.

(If this sounds somewhat circuitous, it is, but that's how ADFS works.)

I was having trouble getting this to work with ureq. I'm using an Agent (for automatic cookie persistence) but the login procedure kept failing at step 4. On a hunch I used redirect(0) on the POST in step 2, extracted the cookies from the response and did the redirect request "manually" and things suddenly worked. This seems to indicate that cookies set during a request in a chain of redirects are not used in subsequent requests.

[jsha]

Thanks for the report! It looks like cookies are only saved for the first request in a redirect chain:

ureq/src/unit.rs

Line 188 in 87b8a38

save_cookies(&unit, &resp);

Will fix.

[jsha]

An update on the above: I misread the code, and cookies are in fact saved on redirects after the first. I wrote a unittest (#127) to verify. Probably something else is going on. Are you able to share a sample of your code that triggered this problem so I can further debug?

[jsha]

By the way, we had a bug until recently: #130. When multiple cookies were present, we would send multiple Cookie headers instead of just one. That could also explain this behavior, depending on whether multiple cookies were in use.

[nico-abram]

Can this be closed? AIUI this is fixed, and has had no response from @mdirkse in a long time

[mdirkse]

Hi, yeah, sorry for the radio silence, the code that showed this behavior hasn't been exercised in quite some time, so I'll close it for now and if I hit it again I'll post a more thorough reproducer.