Skip to content

fix core: storing all cookies without possibly wrong selection, keeping session cookies semantics#1292

Draft
alex-aparin wants to merge 11 commits into
userver-framework:developfrom
alex-aparin:cookies_fix
Draft

fix core: storing all cookies without possibly wrong selection, keeping session cookies semantics#1292
alex-aparin wants to merge 11 commits into
userver-framework:developfrom
alex-aparin:cookies_fix

Conversation

@alex-aparin

Copy link
Copy Markdown
Contributor

As mentioned previously in issue #1182. The current implementation of cookie storage in clients::http::response does not conform to RFC 6265 (it can incorrectly write cookies). Additionally, the accessor methods for Max-Age/Expires have default values, which is also incorrect (breaking the semantics for Session Cookies). The goal of this PR is primarily to fix the incorrect cookie writing, but without a full-fledged implementation of CookiesJar.


Note: by creating a PR or an issue you automatically agree to the CLA. See CONTRIBUTING.md. Feel free to remove this note, the agreement holds.

@alex-aparin

alex-aparin commented Jul 16, 2026

Copy link
Copy Markdown
Contributor Author

UPD: I have noticed some updates in master branch like this. Please note that just overwriting cookie with the same name is not enough, you should take into account expire/max age and domains/urls, because in some cases we should delete cookie at all or just keep additional cookie with the same name but for another domain/url. That's why I am just recording all cookies without any actions (without implementing full cookiejar)

@Malevrovich

Copy link
Copy Markdown
Contributor

Hi, and thanks for the PR!

I’m not fully comfortable with the idea of putting all cookies into a vector. At the very least, this changes the public API, and I’m pretty sure many users rely on the current way cookies are exposed and read.

Would you be interested in properly supporting the cases that don’t fully comply with the RFC instead? I’d be happy to review such a change and help get it merged.

I’d prefer to avoid moving everyone from a map to a vector now, only to potentially move them back to a map later.

@alex-aparin
alex-aparin marked this pull request as draft July 16, 2026 09:33
@alex-aparin

alex-aparin commented Jul 16, 2026

Copy link
Copy Markdown
Contributor Author

Hi all. Thank you for response. There was hot discussion in userver's telegram group about breaking changes, I'll make this pr as draft, additional tests for tricky cookies will be added. I think the better way is to add additional method to allow user to specify - use old but wrong api with the same semantics (map of cookies) or use new method which will return CookieJar with needed getters (some kind of map of map (or map of list) can be used internally)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants