Skip to content
This repository was archived by the owner on Feb 8, 2023. It is now read-only.

Conversation

@FagnerMartinsBrack
Copy link
Member

@FagnerMartinsBrack FagnerMartinsBrack commented May 2, 2015

  • set
  • get
  • remove
  • attributes
  • converter instances
  • JSON serialization
  • initial encoding
  • default path attribute to /
  • sync encoding with client-side
  • make it possible to change a single default property of default attributes
  • if the path attribute is removed, use the whole site. To be consistent with js-cookie behavior.
  • Implement specific encoding rules for the cookie value, to be consistent with js-cookie
  • Do not quote the cookie value when sending to the client. Let's add sauce labs later to test if this is ok for all browsers.
  • Fix window.global_test_results not working for the integration test
  • Implement specific encoding rules for the cookie name, to be consistent with js-cookie
  • Set HttpOnly attribute

@FagnerMartinsBrack
Copy link
Member Author

Can't use the request.getCookies() with at least servlet 3.0.1 implementation of JBoss 7.2.0.Final when the cookie-value contains a colon (:). The request.getCookies() API returns null.

In this case I believe the solution will be using request.getHeader( "Cookie" ) for reading.

Additional resources:
https://bz.apache.org/bugzilla/show_bug.cgi?id=48409


Also, probably need to find a way to workaround the following condition inside the javax.servlet.http.Cookie implementation of Servlet in JBoss when working with the cookie-name:

Servlet Cookie internals from JBoss 7.2.0.Final

It declares special characters...

static {
    if (Boolean.valueOf(System.getProperty("org.glassfish.web.rfc2109_cookie_names_enforced", "true"))) {
        TSPECIALS = "/()<>@,;:\\\"[]?={} \t";
    } else {
        TSPECIALS = ",; ";
    }
}

It verifies if the given string contains a special character...

/*
 * Tests a string and returns true if the string counts as a 
 * reserved token in the Java language.
 * 
 * @param value the <code>String</code> to be tested
 *
 * @return <code>true</code> if the <code>String</code> is a reserved
 * token; <code>false</code> otherwise
 */
private boolean isToken(String value) {
    int len = value.length();
    for (int i = 0; i < len; i++) {
        char c = value.charAt(i);
        if (c < 0x20 || c >= 0x7f || TSPECIALS.indexOf(c) != -1) {
            return false;
        }
    }

    return true;
}

It throws an error if the cookie-name contains special characters upon instantiation...

/**
* Constructs a cookie with the specified name and value.
*
* <p>The name must conform to RFC 2109. However, vendors may
* provide a configuration option that allows cookie names conforming
* to the original Netscape Cookie Specification to be accepted.
*
* <p>The name of a cookie cannot be changed once the cookie has
* been created.
*
* <p>The value can be anything the server chooses to send. Its
* value is probably of interest only to the server. The cookie's
* value can be changed after creation with the
* <code>setValue</code> method.
*
* <p>By default, cookies are created according to the Netscape
* cookie specification. The version can be changed with the 
* <code>setVersion</code> method.
*
* @param name the name of the cookie
*
* @param value the value of the cookie
*
* @throws IllegalArgumentException  if the cookie name is null or
* empty or contains any illegal characters (for example, a comma,
* space, or semicolon) or matches a token reserved for use by the
* cookie protocol
*
* @see #setValue
* @see #setVersion
*/
public Cookie(String name, String value) {
if (name == null || name.length() == 0) {
    throw new IllegalArgumentException(
            lStrings.getString("err.cookie_name_blank"));
}
if (!isToken(name) ||
        name.equalsIgnoreCase("Comment") || // rfc2019
        name.equalsIgnoreCase("Discard") || // 2019++
        name.equalsIgnoreCase("Domain") ||
        name.equalsIgnoreCase("Expires") || // (old cookies)
        name.equalsIgnoreCase("Max-Age") || // rfc2019
        name.equalsIgnoreCase("Path") ||
        name.equalsIgnoreCase("Secure") ||
        name.equalsIgnoreCase("Version") ||
        name.startsWith("$")) {
    String errMsg = lStrings.getString("err.cookie_name_is_token");
    Object[] errArgs = new Object[1];
    errArgs[0] = name;
    errMsg = MessageFormat.format(errMsg, errArgs);
    throw new IllegalArgumentException(errMsg);
}

this.name = name;
this.value = value;
}

@FagnerMartinsBrack
Copy link
Member Author

I removed the usage of javax.servlet.http.Cookie and HttpServletResponse#getCookies/HttpServletResponse#addCookie, there's too many useless rules like quoting the cookie value for certain characters when using .addCookie or ignoring a cookie created as c=: when using .getCookies.

FagnerMartinsBrack added a commit that referenced this pull request Jun 7, 2015
Initial implementation
@FagnerMartinsBrack FagnerMartinsBrack merged commit 8930b4e into master Jun 7, 2015
@FagnerMartinsBrack FagnerMartinsBrack deleted the wip branch June 7, 2015 21:39
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants