You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
It seems the cookie handling is a complex topic and the delimiters are not clearly specified. When I look at Tomcat's cookie source code, they have different scenarios where they treat even more characters as delimiters (i.e. all HTTP RFC2616 token delimiters, which would include ?/(){} etc.)
I suggest we add these token delimiters in the RE_BAD_CHAR regexp so containing strings get quoted; I think it won't break things if we foresightfully add some more quotes (I don't see a case where additional quotes would cause a problem).
For now, I'm monkey patching the cookie library to work around this:
I couldn't confirm the part about how browsers quote cookie values. As far as I could observe, if I set a cookie foo=bar?baz in Chrome and Firefox (both are the latest stable versions) they would send Cookie: foo=bar?baz; other_cookies.... There were no double quotes.
If I fed them foo="bar?baz" they'd send Cookie: foo="bar?baz"; other_cookies..., and if I fed them foo="bar; baz" then Cookie: foo="bar; other_cookies.... So, I could only conclude that they don't support double quotes at all. (!)
So, my question here is, doesn't the server actually send a Set-Cookie header with the value double-quoted? If that's the case, I guess the problem is in the parser that unquotes the double quoted value, not in the serializer to compose a Cookie header value.
I'm using mechanize for some automation purposes and noticed that a Cookie value is not correctly received on Tomcat 7.
Mechanize sends:
Tomcat 7 treats ? as a cookie separator while parsing and thus only receives
COOKIE_NAME => /context/UI/Login
.Current browsers treat ? also as separator and send the cookie value quoted:
Mechanize/http-cookie only treats some control characters and ,;\ as delimiters to determine whether cookie values should be quoted:
http-cookie/lib/http/cookie/scanner.rb
Line 13 in 405a48b
It seems the cookie handling is a complex topic and the delimiters are not clearly specified. When I look at Tomcat's cookie source code, they have different scenarios where they treat even more characters as delimiters (i.e. all HTTP RFC2616 token delimiters, which would include ?/(){} etc.)
I suggest we add these token delimiters in the
RE_BAD_CHAR
regexp so containing strings get quoted; I think it won't break things if we foresightfully add some more quotes (I don't see a case where additional quotes would cause a problem).For now, I'm monkey patching the cookie library to work around this:
Thanks for your great work!
The text was updated successfully, but these errors were encountered: