bugdavfs2 - Bugs: bug #63118, support for multiple cookies does...


bug #63118: support for multiple cookies does not work

Submitter:  None
Submitted:  Wed 28 Sep 2022 12:50:48 AM UTC
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup

Thu 29 Sep 2022 12:48:20 AM UTC, comment #3: 

Oh and this is where Neon merges (concatenates) the values of headers with same name: https://github.com/notroj/neon/blob/f52d2c9d1fd3bb9527562930856e4d1de91f2267/src/ne_request.c#L1155

Sylvain <whyspee>
Thu 29 Sep 2022 12:46:57 AM UTC, comment #2: 

Forget about the workaround I proposed, sorry. It's actually not a solution. Neon is definitely the problem here.

Sylvain <whyspee>
Thu 29 Sep 2022 12:31:03 AM UTC, comment #1: 

Well, the problem lays in the way Neon stores the headers.
Whether we use X or Y, the problem is the same.

Unfortunately, if in the HTTP response there are several headers with the same name, Neon will merge them like if there was only one header in the HTTP response. How it merges the value of all headers with the same? It concatenates the value and uses ", " as a separators between header values.

This is quite problematic because the string ", " is sometimes contained in the value of a "Set-Cookie" header.
Indeed, cookies have expiration date usually, so it's very common that the value of a "Set-Cookie" header contains for example: "expires=Fri, 31-Dec-2100 23:59:59 GMT".

In the end, once Neon gives us the value of the merged "Set-Cookie" header, there's easy no way to distinguished between Neon's header values separator and the separator between the weekday and day of month. They are the same separator : ", ".

The best would be an API change in Neon of course. But as a quicker workaround, we could imagine checking the grammar of that merged "Set-Cookie" value to be able to understand when a cookie parameter starts and where it finishes.

Sylvain <whyspee>
Wed 28 Sep 2022 12:50:48 AM UTC, original submission:  


After experimenting and reading the source code, I've found out that n_cookies configuration parameter doesn't work as expected. It works only for one cookie. Not more.

This is due to the way cookies are read. In the code, we wrongly assume that all cookies would be defined in a single "Set-Cookie" header. We seem to assume that cookies are defined/declared (via Set-Cookie header) the same way as they are used (via Cookie) header. While in fact each cookie is defined/declared via a single "Set-Cookie" header. Thus a HTTP response may contain multiple "Set-Cookie" header. This is normal.

To summarize, we use cookies correctly (correct usage of "Cookie" header I mean) but we are wrong at reading a cookie definition/declaration ("Set-Cookie" header).

The function get_cookies of webdav.c needs a fix.

I think this is a regression that is caused by a bugfix related to cookies. I didn't check carefully but I suspect the bugfix https://savannah.nongnu.org/bugs/?58459 (58459) to be responsible of this bug.

This is why this bug has been introduced since version 1.6.0.

Unfortunately, I'm not so confortable with C to provide a fix right now, but I think it should be not so difficult to fix...



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by whyspee (Posted a comment)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.


    No changes have been made to this item

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code