bugdavfs2 - Bugs: bug #63118, support for multiple cookies does...

 
 

bug #63118: support for multiple cookies does not work

Submitter:  None
Submitted:  Wed 28 Sep 2022 12:50:48 AM UTC
   
 
Category:  None Severity:  3 - Normal
Priority:  5 - Normal Item Group:  None
Status:  None Privacy:  Public
Assigned to:  None Open/Closed:  Open
* Mandatory Fields

Post a Comment

Add a New Comment Rich Markup
   

Discussion

Thu 29 Sep 2022 12:48:20 AM UTC, comment #3: 

Oh and this is where Neon merges (concatenates) the values of headers with same name: https://github.co ... e_request.c#L1155

Sylvain <whyspee>
Thu 29 Sep 2022 12:46:57 AM UTC, comment #2: 

Forget about the workaround I proposed, sorry. It's actually not a solution. Neon is definitely the problem here.

Sylvain <whyspee>
Thu 29 Sep 2022 12:31:03 AM UTC, comment #1: 

Well, the problem lays in the way Neon stores the headers.
Whether we use X or Y, the problem is the same.

Unfortunately, if in the HTTP response there are several headers with the same name, Neon will merge them like if there was only one header in the HTTP response. How it merges the value of all headers with the same? It concatenates the value and uses ", " as a separators between header values.

This is quite problematic because the string ", " is sometimes contained in the value of a "Set-Cookie" header.
Indeed, cookies have expiration date usually, so it's very common that the value of a "Set-Cookie" header contains for example: "expires=Fri, 31-Dec-2100 23:59:59 GMT".

In the end, once Neon gives us the value of the merged "Set-Cookie" header, there's easy no way to distinguished between Neon's header values separator and the separator between the weekday and day of month. They are the same separator : ", ".

The best would be an API change in Neon of course. But as a quicker workaround, we could imagine checking the grammar of that merged "Set-Cookie" value to be able to understand when a cookie parameter starts and where it finishes.

Sylvain <whyspee>
Wed 28 Sep 2022 12:50:48 AM UTC, original submission:  

Hello,

After experimenting and reading the source code, I've found out that n_cookies configuration parameter doesn't work as expected. It works only for one cookie. Not more.

This is due to the way cookies are read. In the code, we wrongly assume that all cookies would be defined in a single "Set-Cookie" header. We seem to assume that cookies are defined/declared (via Set-Cookie header) the same way as they are used (via Cookie) header. While in fact each cookie is defined/declared via a single "Set-Cookie" header. Thus a HTTP response may contain multiple "Set-Cookie" header. This is normal.
https://developer ... eaders/Set-Cookie

To summarize, we use cookies correctly (correct usage of "Cookie" header I mean) but we are wrong at reading a cookie definition/declaration ("Set-Cookie" header).

The function get_cookies of webdav.c needs a fix.

I think this is a regression that is caused by a bugfix related to cookies. I didn't check carefully but I suspect the bugfix https://savannah. ... u.org/bugs/?58459 (58459) to be responsible of this bug.

This is why this bug has been introduced since version 1.6.0.

Unfortunately, I'm not so confortable with C to provide a fix right now, but I think it should be not so difficult to fix...

Anonymous

 

Attached Files

This item currently has no attached files.

(Note: upload size limit is set to 4.0MiB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

 

Dependencies

This item does not depend on any other items.

No items depend on this one.

 

Mail Notification Carbon-Copy List

Carbon-Copy List
  • -email is unavailable- added by whyspee (Posted a comment)
  •  

    Votes

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

    History

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.16-a7ba.
    Corresponding source code