Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] ctx.RemoveCookie need more special attribute(domain and path) value to remove cookies #2309

Closed
leavesster opened this issue Dec 13, 2023 · 3 comments
Assignees

Comments

@leavesster
Copy link

Describe the bug

I can't say whether is a bug or by design. Maybe it by design, if it's by design I think some comment or tips need to point out at least.

ctx.RemoveCookie is just remove cookie by name with no domain and path value.
According the rfc 6265 -- 4.1.2 Semantics (Non-Normative) said:

the user agent receives a new cookie with the same cookie-name,
domain-value, and path-value as a cookie that it has already stored,
the existing cookie is evicted and replaced with the new cookie.

so when I use this function to remove cookie, the domain value and the path value should the same as the user's local cookies.

I know that the ctx.RemoveCookie is support to pass CookieOption to set. But incase someone maybe encounter my case which I debug a long time to find the problem
To Reproduce
Steps to reproduce the behavior:

  1. git clone my fork with remove-cookie-not-work-branch
  2. cd _examples/cookies/remove
  3. go run main.go
  4. open browser, first visit http://localhost:8080/cookies/add/k/v
  5. then visit http://localhost:8080/cookies/remove/k
  6. open the dev-tools with http://localhost:8080/cookies/remove/k address
  7. select the Application tab and find the cookies, you will see the k cookie is not removed

Expected behavior

Screenshots

2 1

Desktop (please complete the following information):

  • OS: [e.g. ubuntu, windows]

iris.Version
main

Please make sure the bug is reproducible over the main branch:

$ cd PROJECT
$ go get -u github.com/kataras/iris/v12@main
$ go run .

Additional context

The except behavior's implement maybe a litter ugly(get cookies by name and then set the domain and path value as the cookies in request if it exist). but I think it should the right behavior.

If you think what I said is ok or a improvement to this API, I'm glad to make a pull request to do this :)

@kataras
Copy link
Owner

kataras commented Dec 25, 2023

Hello @leavesster, it should be fixed on @main version, can you please try to verify it? Thanks a lot for the issue! Don't hesitate to reply back any further issues.

@leavesster
Copy link
Author

Hello @leavesster, it should be fixed on @main version, can you please try to verify it? Thanks a lot for the issue! Don't hesitate to reply back any further issues.

Hello, I've tried to investigate this issue, and unfortunately, it still persists.

Upon analyzing the network requests, I discovered that the browser is sending only the cookie's name and value without including the path and domain information. Consequently, if developers wish to remove a cookie with a specific value and domain, they need to handle it manually.

It seems that the current framework behavior is limited in this regard. The only action it can take is to comment on this behavior:

If you intend to remove a cookie with a specific domain and value, please ensure to pass these values explicitly.

I apologize for providing an incorrect solution previously.

kataras added a commit that referenced this issue Dec 30, 2023
@kataras
Copy link
Owner

kataras commented Dec 30, 2023

Hello @leavesster, thanks a lot for your feedback. I reverted that code to its previous state, and added iris.CookieDomain and iris.CookieOverride so end-developers can use CookieDomain and CookiePath to set their values with ease. Added godoc comments too

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants