-
-
Notifications
You must be signed in to change notification settings - Fork 1.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Validate cookie name prefixes #10648
Validate cookie name prefixes #10648
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pedantic: whitespaces
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm doubting this is a good change in terms of API design. Now validate_name
not just validates the name itself but in the context of other values. This creates some implicit restrictions when using the API in a builder flow, enforcing a specific order of property assignments.
I would suggest to add a dedicated method to validate the entire cookie. This validation could be applied automatically in parse_set_cookie
.
@straight-shoota
I don't see how this could be avoided. Otherwise you could "build" an invalid cookie and wouldn't even know it. |
The answer is that in order to validate the cookie value, you need to validate explicitly when building an instance. I don't think a setter should apply implicit validation on an incomplete cookie. |
@straight-shoota Oh I see. You were proposing this method be public, then just also call it in the constructor. What are your thoughts on how it should work then? Like |
Prob. both? |
Better supports Cookie builder pattern
…roperties are unset
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you @Blacksmoke16 🙏
Validates cookie names with prefixes as per https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-05#section-4.1.3.
I'm also not really sure why the other name/value validation raises an
IO::Error
? Seems more appropriate as anArgumentError
.