sharanggupta opened a new pull request, #3616: URL: https://github.com/apache/cxf/pull/3616
https://issues.apache.org/jira/browse/CXF-9072 `NewCookieHeaderProvider.fromString` treats every attribute it doesn't recognize as the cookie's name=value pair, so `foo=bar;SameSite=Lax` is parsed as a cookie named `SameSite` with value `Lax`. `toString` drops SameSite, so a `NewCookie` built with `sameSite(...)` loses the attribute in the Set-Cookie header and in `Response.getCookies()`. Changes: - The first name=value pair is the cookie. Later unrecognized attributes are ignored, as in RFC 6265, section 5.2. Empty segments are skipped. - `SameSite` is parsed case-insensitively into `NewCookie.SameSite`. An unrecognized value is ignored. - `toString` writes `SameSite=Strict|Lax|None`. Tests: new `NewCookieHeaderProviderTest` cases cover parsing, case-insensitivity, unknown SameSite values, unknown attributes, `toString`, empty segments, and a round trip. The SameSite and unknown-attribute cases fail without the change. `mvn -pl rt/frontend/jaxrs -am test` with `NewCookieHeaderProviderTest`, `CookieHeaderProviderTest` and `ResponseImplTest` passes, including checkstyle and PMD. The JIRA issue is assigned to @reta. I'm happy to close this if you already have a fix in progress. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
