Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Capture all repeated `Cookie` and `Set-Cookie` header values

未关闭
  • 哪里不对？
#5,982 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
52/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
活跃
技术栈
java, kotlin
领域
api, security, testing

调研方向

先检查 OkHttp、Ktor、Apollo 3 和 Apollo 4 集成中现有的 cookie 提取和 header 访问路径，然后比较其他 SDK 如何处理重复 header。在运行集成测试之前，跟踪共享的 cookie 策略以及缺少 Data-Collection 时的行为。完成的标准是：覆盖重复的 Cookie 和 Set-Cookie 值，且不会进行不安全的逗号处理；过滤仍然有效；格式错误的值 fail closed。

由索引模型根据 Issue 内容生成。

描述

Feature Java Platform: Java

Problem

The OkHttp, Ktor, and Apollo integrations capture only one Cookie or Set-Cookie header value when creating request and response contexts. Their current header accessors select a single value, so additional cookie fields are omitted from Sentry telemetry.

This is valid HTTP behavior. In particular, HTTP/2 allows clients to split the Cookie field into multiple header fields for compression. Responses also commonly contain multiple Set-Cookie fields.

This is follow-up completeness work from #5811 and supports #5666.

Check what other SDKs are doing before implementing.

Proposed solution

Make cookie extraction list-aware across OkHttp, Ktor, Apollo 3, and Apollo 4:

  • Combine repeated request Cookie fields with ; before applying the effective cookie policy.
  • Process each response Set-Cookie field independently because each field represents one cookie and its attributes.
  • Do not comma-join or comma-split Set-Cookie values. A valid Expires attribute contains a comma.
  • Add shared core helpers or integration-specific adapters that apply the effective cookie policy to every value.
  • Preserve valid Set-Cookie attributes and fail closed for malformed input.

Preserve the existing absent-Data-Collection compatibility behavior for each integration.

Acceptance criteria

  • OkHttp, Ktor, Apollo 3, and Apollo 4 capture all repeated cookie header values supported by their header APIs.
  • Multiple request Cookie fields are combined with ; and filtered as one cookie string.
  • Multiple response Set-Cookie fields are filtered independently without comma splitting or joining.
  • Built-in sensitive-cookie filtering and configured allow-list, deny-list, and off behavior apply to every cookie value.
  • Malformed cookie values never bypass filtering.
  • Integration tests cover at least two request Cookie fields and two response Set-Cookie fields where the underlying header API supports repeated values.
主要语言
Kotlin
星标
1.4k
派生
478
平均合并
2 天 15 小时
30 天内合并 PR
65

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

getsentry/sentry-java 的其他 Issue

查看 getsentry/sentry-java 的全部 Issue

相似的 Issue

更多 Kotlin Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。