Issue 2482: accept empty cookies names #2676
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
The change is to skip merging logic for cookies without a name to avoid NPE. Also, we can not merge a cookie if the cookie's name is unavailable.
According to rfc6265, SetCookies processing logic does follow several steps to parse cookies; in general, a client should ignore the cookie when the name is not available
If the name-value-pair string lacks a %x3D ("=") character, ignore the set-cookie-string entirely.
There is one edge case related to redirect which this change does not cover:
'Set-Cookie': '; foo1=bar1'
-> redirects to /path2'Set-Cookie': 'foo2=bar2'
This will result in
instead of
In this case, because Apache HTTP client correctly implements RFC cookies for /path1, the
foo1=bar1
won't be set as the name for the cookie is null.On the other hand, the Netty ClientCookieDecoder would for the same cookie parse it with the name
foo1
and valuebar1.
So this
'Set-Cookie': 'foo1=bar1'
-> redirects to /path2'Set-Cookie': '; foo2=bar2'
Will result in a different result
['foo1=bar1; Domain=localhost', '; foo2=bar2']
This makes the behaviour inconsistent; however, we would need to use the same cookie parser for the original cookie store and redirect to make the behaviour the same