Redirects cause multiple Cookie headers to be sent

[dotdash]

When following a redirect, the Cookie header is retained, but then in Unit::new(), a new Cookie header is created from the contents of the cookie store. Therefore, each redirect adds another Cookie header.

[2023-05-11T14:40:16Z DEBUG ureq::unit] writing prelude: GET / HTTP/1.1
    Host: retracted
    User-Agent: ureq/2.6.2
    Accept: */*
    Content-Type: application/x-www-form-urlencoded
    accept-encoding: gzip
    Cookie: ***
    Cookie: ***
    Cookie: ***
    Cookie: ***

This violates https://httpwg.org/specs/rfc6265.html#cookie which says:

When the user agent generates an HTTP request, the user agent MUST NOT attach more than one Cookie header field.

[algesten]

Hi Björn! Welcome to ureq!

This does indeed seem wrong. We should fix it.

[PizlaTheDeveloper]

Hi, should be resolved with #608 , or not?

[alexkingnz]

I was bitten by this. The site I'm accessing has some redirects (within the same domain) while checking credentials. Unfortunately, if the client duplicates the session cookie authorization will fail. Took me a while to figure that out.

dotdash's fix works for me.

[algesten]

Closing since we're moving to ureq 3.x. It is probably fixed there.