Skip to content

fix serialization of cookies#2307

Open
karenetheridge wants to merge 1 commit intomojolicious:mainfrom
karenetheridge:ether/fix-cookie-serialization
Open

fix serialization of cookies#2307
karenetheridge wants to merge 1 commit intomojolicious:mainfrom
karenetheridge:ether/fix-cookie-serialization

Conversation

@karenetheridge
Copy link
Copy Markdown
Contributor

Comment thread t/mojo/headers.t
@kraih
Copy link
Copy Markdown
Member

kraih commented Mar 21, 2026

I think there was a reason we don't do this, but i don't quite remember. Cookie headers had to be split up into multiple headers with the same name and not joined as a string or it caused some bugs. 🤔

Edit: I was mixing up Cookie and Set-Cookie.

Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates Mojo::Headers cookie handling to comply with RFC 6265 by ensuring cookies serialize as a single Cookie header and use "; " as the cookie-pair delimiter.

Changes:

  • Update Mojo::Headers to join multiple Cookie values using "; " (instead of ", "), including special handling in to_string.
  • Adjust header value joining logic to treat Cookie differently from other headers.
  • Add tests asserting correct Cookie and general header serialization from from_hash.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File Description
t/mojo/headers.t Adds assertions for to_string output and correct cookie flattening via from_hash/to_hash.
lib/Mojo/Headers.pm Implements Cookie-specific joining in header() and to_string, and updates append() delimiter behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread lib/Mojo/Headers.pm Outdated
Comment thread lib/Mojo/Headers.pm Outdated
Comment thread lib/Mojo/Headers.pm Outdated
Comment thread t/mojo/headers.t
@karenetheridge karenetheridge force-pushed the ether/fix-cookie-serialization branch 3 times, most recently from 289ad7a to 91de7bd Compare March 21, 2026 19:37
Comment thread lib/Mojo/Headers.pm Outdated
Comment thread lib/Mojo/Headers.pm Outdated
Comment thread lib/Mojo/Headers.pm Outdated
Comment thread lib/Mojo/Headers.pm Outdated
@kraih
Copy link
Copy Markdown
Member

kraih commented Mar 23, 2026

The header code is quite performance critical, any CPU cycles you can save will add up.

@karenetheridge karenetheridge force-pushed the ether/fix-cookie-serialization branch from 91de7bd to 8dfe2a1 Compare March 24, 2026 22:02
@karenetheridge
Copy link
Copy Markdown
Contributor Author

karenetheridge commented Mar 24, 2026

cleaned up, with unnecessary lc removed:

  • in the monkey-patched named subs, $name is always in lowercase
  • in append and header, name could be in any case and must be normalized
  • in to_string, the names method always returns uppercase names

I also inlined a local variable so a string comparison is done only when needed, and created a local var in the monkey-patched method to avoid a runtime calculation.

@karenetheridge karenetheridge force-pushed the ether/fix-cookie-serialization branch 4 times, most recently from aae4553 to 7d9607f Compare March 24, 2026 22:14
- only one Cookie header is permitted; all cookies must be in a single string
  (see https://www.rfc-editor.org/rfc/rfc6265#section-5.4)
- the delimiter between individual cookie-pairs is "; ", not ", "
  (see https://www.rfc-editor.org/rfc/rfc6265#section-4.2.1)
@karenetheridge karenetheridge force-pushed the ether/fix-cookie-serialization branch from 7d9607f to 7f964d9 Compare March 24, 2026 22:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants