Skip to content

Remove the noisy "Cookie tried to set to another path" log - #5530

Merged
shai-almog merged 1 commit into
masterfrom
remove-cookie-path-warning
Aug 6, 2026
Merged

Remove the noisy "Cookie tried to set to another path" log#5530
shai-almog merged 1 commit into
masterfrom
remove-cookie-path-warning

Conversation

@shai-almog

Copy link
Copy Markdown
Collaborator

Reported in discussion #5528 — this line floods device logs, several entries per request, continuously.

ConnectionRequest.parseCookieHeader logged a warning whenever a Set-Cookie Path attribute was not a prefix of the request path, and then honored that path anyway:

if (Util.getImplementation().getURLPath(url).indexOf(path) != 0) {
    Log.p("Warning: Cookie tried to set to another path");
    c.setPath(path);
}

Two reasons to drop it:

  • It warns about nothing actionable. The domain check directly above it (ConnectionRequest.java:1681) rewrites the cookie's domain, so its log tells you a cookie was altered. The path branch changes nothing about the outcome — it flags the code doing the correct thing.
  • It fires on valid cookies. RFC 6265 places no requirement on Path relative to the request URI; browsers accept any path. And CodenameOneImplementation.getURLPath returns the host when the URL has no path, so https://example.com yields "example.com" and a plain Path=/ cookie warns on every single response. The check is also indexOf rather than a prefix test, so /v1 inside /api/v1/x matches at index 4 and warns too.

Only the log line is removed. Cookie parsing behavior is unchanged: when the condition is false the cookie keeps Cookie's default "/" path exactly as before.

Tightening the check itself (making setPath unconditional, per RFC) would narrow cookie scope for existing apps, so that is deliberately left out of this PR.

🤖 Generated with Claude Code

…#5528)

parseCookieHeader logged a warning whenever a Set-Cookie Path attribute
was not a prefix of the request path, then honored the path anyway. Unlike
the domain check just above it, which rewrites the cookie's domain, this
branch changes nothing about the outcome, so the log flagged the code
doing the correct thing.

It also fires on perfectly valid cookies. RFC 6265 places no requirement
on Path relative to the request URI, and getURLPath returns the host when
the URL has no path, so a plain "Path=/" cookie on a request to
https://example.com warns on every response. Reported on device as several
lines per request, continuously.

Only the log line is removed; cookie parsing behavior is unchanged.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@shai-almog
shai-almog merged commit 3f50087 into master Aug 6, 2026
4 checks passed
@shai-almog
shai-almog deleted the remove-cookie-path-warning branch August 6, 2026 21:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant