net/http: Request.Cookie returns first cookie when name is empty

[muyizixiu]

What version of Go are you using (go version)?

$ go version
go version go1.17.9 linux/amd64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/data/root/.cache/go-build"
GOENV="/data/root/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/go/pkg/mod"
GONOPROXY=""
GONOSUMDB="github.com/galeone/tensorflow"
GOOS="linux"
GOPATH="/go"
GOPRIVATE=""
GOPROXY=""
GOROOT="/usr/local/go"
GOSUMDB="sum.woa.com+643d7a06+Ac5f5VOC4N8NUXdmhbm8pZSXIWfhek5JSmWdWrq7pLX4"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.17.9"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/data/micro/admin/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build2273884838=/tmp/go-build -gno-record-gcc-switches"
GOROOT/bin/go version: go version go1.17.9 linux/amd64
GOROOT/bin/go tool compile -V: compile version go1.17.9
uname -sr: Linux 3.10.107-1-tlinux2_kvm_guest-0052
/lib64/libc.so.6: GNU C Library (GNU libc) development release version 2.34.9000.

What did you do?

see link blow
https://go.dev/play/p/svsT3co5Y_X

What did you expect to see?

it suppose to return http.ErrNoCookie

What did you see instead?

unexpected cookie

[kamly]

the same thing happened to me !!

[muyizixiu]

readCookies will return all cookie when cookie name is empty

it only return matched cookie when filter is not empty

should be fixed by follow

func (r *Request) Cookie(name string) (*Cookie, error) {
	for _, c := range readCookies(r.Header, name) {
		if c.Name == name {
			return c, nil
		}
	}
	return nil, ErrNoCookie
}

[gopherbot]

Change https://go.dev/cl/409754 mentions this issue: net/http: fix unexpected cookie returned by Request.Cookie function w…

[carlmjohnson]

"" is not a valid cookie name. A) It's not clear if this behavior should change. Is anyone relying on this undocumented behavior? B) If it should change, the fix should be

func (r *Request) Cookie(name string) (*Cookie, error) {
	if name == "" {
		return nil, ErrNoCookie
	}
	for _, c := range readCookies(r.Header, name) {
		return c, nil
	}
	return nil, ErrNoCookie
}

[seankhliao]

cc @neild

[kamly]

I think cookie's lack of key is unreasonable and should be pointed out.

[neild]

Given that the current behavior is undocumented, surprising, and doesn't seem to be useful, I think Request.Cookie("") should return ErrNoCookie.