Cookie parsing does not adhere to RFC (concerning multiple values with the same key)
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 45/100
- Issue type
- Documentation
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- rust
- Domain
- documentation
Research direction
Review src/common/cookie.rs, especially Cookie::get, alongside RFC 6265 section 4.2.2. Determine where its behavior is documented and update that documentation to explain handling of duplicate cookie names and the ordering caveat; done means the behavior and its security implications are clear to users.
Written by the indexing model from the issue text.
Description
According to to the quoted RFC 6265, section 4.2.2
Although cookies are serialized linearly in the Cookie header,
servers SHOULD NOT rely upon the serialization order. In particular,
if the Cookie header contains two cookies with the same name (e.g.,
that were set with different Path or Domain attributes), servers
SHOULD NOT rely upon the order in which these cookies appear in the
header.
The relevant function Cookie::get does not comply with that:
https://github.com/hyperium/headers/blob/ffca4a90482cc31875ac9a9364b7ea252f8c0afa/src/common/cookie.rs#L45-L49
Instead, it only takes the first cookie value of a certain name.
The documentation should call this out, especially if this is not a de-facto standard somewhere because then it can create security vulnerabilities with different parts of a web stack taking different (first, last) values of a cookie with a certain name as authoritative.
- Dominant language
- Rust
- Stars
- 200
- Forks
- 107
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from hyperium/headers
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
-
Difficulty 3/5 1-2 days Newbie friendliness 78/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
-
Link support Open
Difficulty 4/5 3-5 days Newbie friendliness 38/100
All issues in hyperium/headers
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
issue
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
agentic-workflows
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
web-infra-dev/rspack#15847 ·