nagarajusunkara opened a new issue, #12452: URL: https://github.com/apache/apisix/issues/12452
### Current Behavior **Bug Description** The Lua-based cookie parser in APISIX fails to handle certain valid cookie formats, specifically when cookie values contain spaces or are quoted (e.g., "foo bar"), or when there are spaces around =. Instead of correctly associating the entire value with the key, the parser truncates values or incorrectly creates extra keys from portions of the value after a space. This leads to data loss and misinterpretation of client state. **How to Reproduce** Send a request to APISIX with a Cookie header like: ```bash Cookie: session="foo bar baz"; locale = en US ; foo = spaced out ; badflag; ``` Use any Lua plugin or code that retrieves cookies using the built-in parser (e.g., cookie:get_all() or cookie:get()). https://github.com/apache/apisix/blob/master/apisix/core/ctx.lua#L288 Observe the parsed result, which may look like: ```javascript { session: '"foo', bar baz: (missing or empty), locale: 'en', US: (missing or empty), foo: 'spaced', out: (missing or empty), badflag: (empty or true) } ``` Instead of: ```javascript { session: 'foo bar baz', locale: 'en US', foo: 'spaced out', badflag: '' } ``` Minimal Reproducible Example ```lua local cookie_str = 'session="foo bar baz"; locale = en US ; foo = spaced out ;' local cookies = parse_cookies(cookie_str) -- using built-in or naive parser -- cookies["session"] == '"foo' -- cookies["bar baz"] == nil -- cookies["locale"] == 'en' -- cookies["US"] == nil -- cookies["foo"] == 'spaced' -- cookies["out"] == nil ``` Additional Context The parser’s pattern validation fails with spaces and special formatting. RFC 6265 allows spaces and quoted strings as part of the cookie value. This bug leads to incorrect state tracking or authentication failures for end-users. ### Expected Behavior All cookie values—including those with spaces or quotes—should be fully and correctly associated with their key, as per [RFC 6265](https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.1). ### Error Logs no errors in logs rather malformed cookies being passed in request ### Steps to Reproduce 1. Run APISIX using Docker or Helm 2. create a route with vars condition on route with a cookie - even with valid cookie also the vars condition fails and picks wrong route because cookie parsing is failing and sending bad cookie in request ### Environment - APISIX version (run `apisix version`): 3.11 - Operating system (run `uname -a`): Linux - OpenResty / Nginx version (run `openresty -V` or `nginx -V`): - etcd version, if relevant (run `curl http://127.0.0.1:9090/v1/server_info`): - APISIX Dashboard version, if relevant: - Plugin runner version, for issues related to plugin runners: - LuaRocks version, for installation issues (run `luarocks --version`): -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
