Don't try to sign empty cookie values

nelmio · Sep 3, 2022 · 7cc3a47 · 7cc3a47
1 parent defbe00
commit 7cc3a47
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 1 deletion.
diff --git a/src/EventListener/SignedCookieListener.php b/src/EventListener/SignedCookieListener.php
@@ -72,7 +72,7 @@ public function onKernelResponse(ResponseEvent $e): void
         $response = $e->getResponse();
 
         foreach ($response->headers->getCookies() as $cookie) {
-            if (true === $this->signedCookieNames || \in_array($cookie->getName(), $this->signedCookieNames, true)) {
+            if ($cookie->getValue() && (true === $this->signedCookieNames || \in_array($cookie->getName(), $this->signedCookieNames, true))) {
                 $response->headers->removeCookie($cookie->getName(), $cookie->getPath(), $cookie->getDomain());
                 $signedCookie = new Cookie(
                     $cookie->getName(),

diff --git a/tests/Listener/SignedCookieListenerTest.php b/tests/Listener/SignedCookieListenerTest.php
@@ -129,4 +129,19 @@ public function testCookieWritingSkipsSubReqs(): void
         $cookies = $response->headers->getCookies(ResponseHeaderBag::COOKIES_ARRAY);
         $this->assertSame('bar', $cookies['']['/']['foo']->getValue());
     }
+
+    public function testCookieWritingHandlesEmptyValue(): void
+    {
+        $listener = new SignedCookieListener($this->signer, ['*']);
+        $request = Request::create('/');
+
+        $response = new Response();
+        $response->headers->setCookie(Cookie::create('foo'));
+
+        $event = $this->createResponseEventWithKernel($this->kernel, $request, true, $response);
+        $listener->onKernelResponse($event);
+
+        $cookies = $response->headers->getCookies(ResponseHeaderBag::COOKIES_ARRAY);
+        $this->assertNull($cookies['']['/']['foo']->getValue());
+    }
 }