Fix #9334 Cookie Compliance #9402
Conversation
Fix incorrect change to RFC6265 to not support dollars in cookie names. Signed-off-by: gregw <[email protected]>
Fix incorrect change to RFC6265 to not support dollars in cookie names. Included updates and tests from #9399 Signed-off-by: gregw <[email protected]>
Fix incorrect change to RFC6265 to not support dollars in cookie names. Included updates and tests from #9399 Signed-off-by: gregw <[email protected]>
|
@sbordet @lorban We were too tough on RFC2965 with our new RFC6265 parser. An attribute from an old cookie is a valid cookie name in RFC6265. So for example: Best way to see how this now works is to look at the test case: |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| cookie.setPath(path); | ||
| if (comment != null) | ||
| cookie.setComment(comment); | ||
| response.addCookie(cookie); |
Check warning
Code scanning / CodeQL
Failure to use secure cookies
Signed-off-by: gregw <[email protected]>
…x-old-docs-remove-logging-sections * upstream/jetty-12.0.x: Issue jetty#9403 sendError(404) not setError(404) for DefaultServlet (jetty#9404) Fix bad merges from jetty-11 revert upgrade from 3aaa65c Fix osgi dependencies for update to org.eclipse.osgi.services. Add ignore .checkstyle fix style Fixed Merge remote-tracking branch 'origin/jetty-11.0.x' into jetty-12.0.x fixing merge Fix jetty#9334 Cookie Compliance (jetty#9402) Bump maven-deploy-plugin from 3.0.0 to 3.1.0 Bump asciidoctorj-diagram from 2.2.3 to 2.2.4 Bump jakarta.servlet.jsp-api from 3.0.0 to 3.1.1 Bump maven-invoker-plugin from 3.4.0 to 3.5.0 Bump maven.surefire.plugin.version from 3.0.0-M8 to 3.0.0-M9 Bump maven-javadoc-plugin from 3.4.1 to 3.5.0 Bump tycho-p2-repository-plugin from 3.0.1 to 3.0.2 Bump maven.version from 3.8.7 to 3.9.0
Fix incorrect change to RFC6265 to not support dollars in cookie names.