Repository navigation
Cookies: drop RFC 2109/2965, follow RFC 6265, add SameSite - #1610
Merged
Merged
Conversation
Cookies are now written in RFC 6265 format only: no Version, Comment or Discard, no quoting, Max-Age together with Expires, and no $Version, $Path or $Domain in the request Cookie header. The matching API (Cookie.get/setVersion, CookieSetting.get/setComment, the constructors taking them) and the Set-Cookie2 support are removed. Reading stays lenient: legacy pairs and attributes are ignored, a comma is no longer a cookie separator, and Max-Age takes precedence over Expires. Added CookieSetting.get/setSameSite. Repeated Cookie headers are joined with semicolons in NettyRequest. CookieAuthenticator no longer lets the next restlet overwrite a login redirection. Issues #1334, #554. Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Split CookieReader.readPair into smaller methods (S3776) and merge the three request Cookie header tests into a parameterized one (S5976). Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Addresses the SonarCloud S1130 finding. Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
|
thboileau-git
added
Module: Restlet API
State: done
Version: 3.0
Version 2.7
and removed
Version 2.7
labels
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Version/Comment/Discard, no quoting,Max-Agetogether withExpires, no$Version/$Path/$Domainin the requestCookieheader.Cookie.get/setVersion,CookieSetting.get/setComment, the constructors taking them, andSet-Cookie2support.Max-Agewins overExpires.CookieSetting.get/setSameSiteand theSameSiteenum.Cookieheaders are joined with;inNettyRequest(HTTP/2 splits cookies).CookieAuthenticatorJavadoc (Add CookieAuthenticator documentation #837) and documents the by-design re-issue of the cookie (CookieAuthenticator: getCredentialsCookie returns always a new cookie #923).SameSite=NonewithoutSecureis not validated.Companion 2.7 PR deprecates the legacy API first.
Test plan
./mvnw -B verify -P default,test(Spotless, JaCoCo, SpotBugs)CookieHeadersTestCase(fails with the old comma joining)🤖 Generated with Claude Code