sharanggupta commented on code in PR #3616:
URL: https://github.com/apache/cxf/pull/3616#discussion_r4350189596
##########
rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/impl/NewCookieHeaderProvider.java:
##########
@@ -137,11 +147,38 @@ public String toString(NewCookie value) {
if (value.isHttpOnly()) {
sb.append(';').append(HTTP_ONLY);
}
+ if (value.getSameSite() != null) {
+
sb.append(';').append(SAME_SITE).append('=').append(toAttributeValue(value.getSameSite()));
+ }
sb.append(';').append(VERSION).append('=').append(value.getVersion());
return sb.toString();
}
+ /**
+ * Matches the SameSite attribute value case-insensitively; an
unrecognized value is ignored,
+ * as the RFC 6265bis draft specifies.
+ */
+ private static NewCookie.SameSite toSameSite(String attributeValue) {
+ for (NewCookie.SameSite sameSite : NewCookie.SameSite.values()) {
+ if (sameSite.name().equalsIgnoreCase(attributeValue)) {
+ return sameSite;
+ }
+ }
+ return null;
+ }
+
+ private static String toAttributeValue(NewCookie.SameSite sameSite) {
Review Comment:
Good call, thanks. Done in 9641972d60: the switch is gone and `toString`
uses
`StringUtils.capitalize(value.getSameSite().name().toLowerCase(Locale.ROOT))`.
I used `Locale.ROOT` because under a Turkish default locale
`"STRICT".toLowerCase()` gives `"strıct"` (dotless ı), so the header would
carry `SameSite=Strıct`. A new test,
`testToStringWithSameSiteUnderTurkishLocale`, covers that case, and it fails
with a plain `toLowerCase()`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
