Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fetch request concatenates Cookie headers with comma instead of semicolon #1905

Closed
Qantas94Heavy opened this issue Feb 3, 2023 · 3 comments · Fixed by #1906
Closed

Fetch request concatenates Cookie headers with comma instead of semicolon #1905

Qantas94Heavy opened this issue Feb 3, 2023 · 3 comments · Fixed by #1906

Comments

@Qantas94Heavy
Copy link

Qantas94Heavy commented Feb 3, 2023

Version

19.6.0

Platform

Darwin MBP.local 22.2.0 Darwin Kernel Version 22.2.0: Fri Nov 11 02:08:47 PST 2022; root:xnu-8792.61.2~4/RELEASE_X86_64 x86_64

Subsystem

No response

What steps will reproduce the bug?

When specifying multiple Cookie headers for a fetch request, the headers will be concatenated using commas instead of semicolons. While this is technically compliant with the WHATWG spec, that spec is based around browser use and causes a risk of incorrect handling by the receiving server.

Example:

fetch('http://localhost:8080/', {
  headers: [
    ['cookie', 'FOO=lorem-ipsum-dolor-sit-amet'],
    ['cookie', 'BAR=the-quick-brown-fox']
  ]
});

How often does it reproduce? Is there a required condition?

No response

What is the expected behavior?

Cookies are separated by semicolons (;).

GET / HTTP/1.1
host: localhost:8080
connection: keep-alive
cookie: FOO=lorem-ipsum-dolor-sit-amet; BAR=the-quick-brown-fox
...

What do you see instead?

Cookies are separated by commas (,).

GET / HTTP/1.1
host: localhost:8080
connection: keep-alive
cookie: FOO=lorem-ipsum-dolor-sit-amet, BAR=the-quick-brown-fox
...

Additional information

Similar issue but on the receiving end: nodejs/node#11256

@aduh95

This comment was marked as outdated.

@marco-ippolito
Copy link
Member

marco-ippolito commented Feb 3, 2023

Node behavior with http.request with cookies is to use ; separator.
Undici fetch behavior is to use , separator.

@Qantas94Heavy

This comment was marked as outdated.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants