Skip to content

Commit

Permalink
fix: cookie names are case sensitive, close #4558
Browse files Browse the repository at this point in the history
  • Loading branch information
slandelle committed May 1, 2024
1 parent e671237 commit 7fff920
Show file tree
Hide file tree
Showing 2 changed files with 11 additions and 19 deletions.
Expand Up @@ -87,10 +87,10 @@ private[http] final case class CookieJar(store: Map[CookieKey, StoredCookie]) {
val keyPath = cookiePath(Option(cookie.path), requestPath)

if (hasExpired(cookie)) {
updatedStore - CookieKey(cookie.name.toLowerCase(Locale.ROOT), keyDomain, keyPath)
updatedStore - CookieKey(cookie.name, keyDomain, keyPath)
} else {
val persistent = cookie.maxAge != Cookie.UNDEFINED_MAX_AGE
updatedStore + (CookieKey(cookie.name.toLowerCase(Locale.ROOT), keyDomain, keyPath) -> StoredCookie(cookie, hostOnly, persistent, nowMillis))
updatedStore + (CookieKey(cookie.name, keyDomain, keyPath) -> StoredCookie(cookie, hostOnly, persistent, nowMillis))
}
}

Expand Down
Expand Up @@ -167,25 +167,17 @@ class CookieJarSpec extends BaseSpec {
cookieStore.get(Uri.create("http://www.foo.com/bar")) should have size 1
}

it should "handle the domain in a case-insensitive manner (RFC 2965 sec. 3.3.3)" in {
it should "handle the domain in a case-insensitive manner" in {
// https://datatracker.ietf.org/doc/html/rfc6265#section-5.1.3
val cookie = decode("ALPHA=VALUE1")
val uri = Uri.create("http://www.foo.com/bar")
val cookieStore = CookieJar(uri, List(cookie), System.currentTimeMillis())

cookieStore.get(Uri.create("http://www.FoO.com/bar")) should have size 1
}

it should "handle the cookie name in a case-insensitive manner (RFC 2965 sec. 3.3.3)" in {
val cookie = decode("ALPHA=VALUE1; Domain=www.foo.com; path=/bar")
val uri = Uri.create("http://www.foo.com/bar/baz")
val cookieStore = CookieJar(uri, List(cookie), System.currentTimeMillis())

val storedCookies = cookieStore.add(uri, List(decode("alpha=VALUE2; Domain=www.foo.com; path=/bar")), System.currentTimeMillis()).get(uri)
storedCookies should have size 1
storedCookies.head.value shouldBe "VALUE2"
}

it should "handle the cookie path in a case-sensitive manner (RFC 2965 sec. 3.3.3)" in {
it should "handle the cookie path in a case-sensitive manner" in {
// https://datatracker.ietf.org/doc/html/rfc6265#section-5.1.4
val cookie = decode("ALPHA=VALUE1")
val uri = Uri.create("http://www.foo.com/foo/bar")
val cookieStore = CookieJar(uri, List(cookie), System.currentTimeMillis())
Expand All @@ -204,7 +196,7 @@ class CookieJarSpec extends BaseSpec {
val cookie = decode("cookie1=VALUE1; Path=/; Domain=foo.org;")
val cookieStore = CookieJar(Uri.create("https://x.foo.org/"), List(cookie), System.currentTimeMillis())

// RFC 6265, 5.1.3. Domain Matching
// https://datatracker.ietf.org/doc/html/rfc6265#section-5.1.3
cookieStore.get(Uri.create("https://y.x.foo.org/")) should have size 1
}

Expand All @@ -220,7 +212,7 @@ class CookieJarSpec extends BaseSpec {
}

it should "should serve cookies based on the host and independently of the port" in {
// rfc6265#section-1 Cookies for a given host are shared across all the ports on that host
// https://datatracker.ietf.org/doc/html/rfc6265#section-1 Cookies for a given host are shared across all the ports on that host
val cookie1 = decode("cookie1=VALUE1; Path=/")
val cookieStore = CookieJar(Uri.create("http://foo.org/moodle/"), List(cookie1), System.currentTimeMillis())

Expand Down Expand Up @@ -293,7 +285,7 @@ class CookieJarSpec extends BaseSpec {
}

it should "should also serve non secure cookies based on the uri scheme" in {
// rfc6265#section-1 Cookies for a given host are shared across all the ports on that host
// https://datatracker.ietf.org/doc/html/rfc6265#section-1 Cookies for a given host are shared across all the ports on that host
val cookie1 = decode("cookie1=VALUE1; Path=/")
val cookieStore = CookieJar(Uri.create("https://foo.org/moodle/"), List(cookie1), System.currentTimeMillis())

Expand All @@ -310,7 +302,7 @@ class CookieJarSpec extends BaseSpec {
}

it should "should not serve secure cookies for a default retrieved http uri scheme" in {
// rfc6265#section-1 Cookies for a given host are shared across all the ports on that host
// https://datatracker.ietf.org/doc/html/rfc6265#section-1 Cookies for a given host are shared across all the ports on that host
val cookie1 = decode("cookie1=VALUE1; Path=/")
val cookieStore = CookieJar(Uri.create("http://foo.org/moodle/"), List(cookie1), System.currentTimeMillis())

Expand All @@ -325,7 +317,7 @@ class CookieJarSpec extends BaseSpec {
}

it should "should serve secure cookies for a specifically retrieved http uri scheme" in {
// rfc6265#section-1 Cookies for a given host are shared across all the ports on that host
// https://datatracker.ietf.org/doc/html/rfc6265#section-1 Cookies for a given host are shared across all the ports on that host
val cookie1 = decode("cookie1=VALUE1; Path=/")
val cookieStore = CookieJar(Uri.create("http://foo.org/moodle/"), List(cookie1), System.currentTimeMillis())

Expand Down

0 comments on commit 7fff920

Please sign in to comment.