Fix #3433 - Multiple cookies with same name are not supported #4390
Conversation
Signed-off-by: tvallin <thibault.vallin@oracle.com>
Signed-off-by: tvallin <thibault.vallin@oracle.com>
tvallin
changed the title
...on/src/test/java/org/glassfish/jersey/tests/e2e/common/message/internal/HeaderUtilsTest.java
Outdated
Show resolved
Hide resolved
| */ | ||
| public static NewCookie getPreferedNewCookie(NewCookie one, NewCookie second) { | ||
|
|
||
| if (!one.getExpiry().equals(second.getExpiry())){ |
There was a problem hiding this comment.
expiry date can be NULL. Isn't it better to use maxAge value?
There was a problem hiding this comment.
There is a difference between expiry and maxAge.
IE does not support maxAge, so most of the servers set expiry rather than maxAge. It is possible to set one or the other.
NewCookie is what comes from the server, and even though maxAge is recommended, expires seems to be more often. But it seems to be one or the other, so we should compare the later from both.
But yes, we should check for NULL, too.
There was a problem hiding this comment.
Well ,regarding check of expiry VS max-age it's good to check them both :)
Regarding setting one or another attribute in request - actually server shall put both. For now I've found that the only browser which does not support max-age attribute is IE.
Per RFC 6265 max-age attribute has precedence over expiry attribute if both are present in request. In my opinion this shall be respected while choosing preferred cookie.
core-common/src/main/java/org/glassfish/jersey/message/internal/HeaderUtils.java
Outdated
Show resolved
Hide resolved
Signed-off-by: tvallin <thibault.vallin@oracle.com>
Signed-off-by: tvallin <thibault.vallin@oracle.com>
Signed-off-by: tvallin <thibault.vallin@oracle.com>
Signed-off-by: tvallin <thibault.vallin@oracle.com>
Signed-off-by: tvallin thibault.vallin@oracle.com
NewCookie :
- pick the latest expiration date
- if same date, take the longest path string
Cookie :
- pick the longest string