Uploaded image for project: 'Undertow'
  1. Undertow
  2. UNDERTOW-2299

RFC-6265 compliant Cookie reading

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Cannot Reproduce
    • Icon: Major Major
    • None
    • 2.3.7.Final
    • Core
    • None

      Hello, Undertow 2.3.7 appears to not be able to parse certain RFC-6265 compliant cookie values when receiving a request.

       
      Specifically, the cookie-octet part of Section 4.1.1 allows a character like ?, but when I run a test against the server with a cookie that includes this, the rest of the value gets skipped.

      Example cookie: test=foo?bar

      What reaches the application: test=foo

      I'm using Undertow with Spring Boot 3.1.2 and when using Tomcat this problem does not happen.

      Debugging reveals that we enter this if-condition: https://github.com/undertow-io/undertow/blob/2.3.7.Final/core/src/main/java/io/undertow/util/Cookies.java#L309

      It looks like I could set allowHttpSepartorsV0 to true, BUT that would also enable characters ; " \ which are explicitly forbidden by RFC-6265.

              mjusko@redhat.com Marek Jusko
              schnapster Dennis Neufeld (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: