Uploaded image for project: 'Quarkus'
  1. Quarkus
  2. QUARKUS-6841

Correctly handle multiple Set-Cookie headers for API Gateway v2

XMLWordPrintable

      Multiple Set-Cookie headers were merged into a single header when running Quarkus as an AWS Lambda behind API Gateway v2. The cause was a case-sensitive check for "set-cookie" in LambdaHttpHandler, while Vert.x HeadersMultiMap normalizes names (e.g., "Set-Cookie") and is case-insensitive. As a result, cookie values were treated as regular headers and comma-joined, breaking multiple-cookie scenarios.
      Change the comparison to equalsIgnoreCase and route Set-Cookie values to the API Gateway v2 cookies array, preserving each cookie as a separate entry and omitting headers.'Set-Cookie' in the Lambda response.
      Also add tests and a small resource to verify behavior:

      CookiesResource to emit one or two cookies via JAX-RS.
      AmazonLambdaSimpleTestCase:

      testSingleCookieByEvent and testMultipleCookiesByEvent assert cookies[] is populated and headers.'Set-Cookie' is absent for API Gateway v2 events.
      testMultipleCookiesDirectHttp asserts direct HTTP responses still return multiple Set-Cookie headers.

      References:

      API Gateway v2 Lambda payload: https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-integrations-lambda.html

      Fixes: #50075

              jmartisk@redhat.com Jan Martiska
              msochure@redhat.com Miroslav Sochurek
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: