brpc icon indicating copy to clipboard operation
brpc copied to clipboard

Fix invalid headers of multiple cookie and set-cookie

Open chenBright opened this issue 1 year ago • 0 comments

What problem does this PR solve?

Issue Number: resolve #2575

Problem Summary:

目前bRPC处理cookie和set-cookie这两个header的逻辑有问题:

  1. RFC 9114规定: 多个cookie不能用,分隔,应该要用;

If a decompressed field section contains multiple cookie field lines, these MUST be concatenated into a single byte string using the two-byte delimiter of "; " (ASCII 0x3b, 0x20) before being passed into a context other than HTTP/2 or HTTP/3, such as an HTTP/1.1 connection, or a generic HTTP server application.

  1. RFC 6265 规定:多个set-cookie不能合并到一个header。

Origin servers SHOULD NOT fold multiple Set-Cookie header fields into a single header field. The usual mechanism for folding HTTP headers fields (i.e., as defined in [RFC2616]) might change the semantics of the Set-Cookie header field because the %x2C (",") character is used by Set-Cookie in a way that conflicts with such folding.

What is changed and the side effects?

Changed:

  1. 多个cookie要用; 分隔;
  2. 内部使用std::unordered_multimap代替butil::CaseIgnoredFlatMap,用来支持同时保存多个set-cookie的特性。为了尽量兼容原来的逻辑: 2.1 GetHeader、SetHeader只对第一个set-cookie生效。当只有一个set-cookie的时候,这两个api的表现不变。 2.2 AppendHeader会直接创建新的set-cookie。 2.3 HeaderBegin和HeaderEnd这两个api表现不变,还是可以遍历到所有header。

Side effects:

  • Performance effects(性能影响):

  • Breaking backward compatibility(向后兼容性):


Check List:

  • Please make sure your changes are compilable(请确保你的更改可以通过编译).
  • When providing us with a new feature, it is best to add related tests(如果你向我们增加一个新的功能, 请添加相关测试).
  • Please follow Contributor Covenant Code of Conduct.(请遵循贡献者准则).

chenBright avatar Mar 19 '24 16:03 chenBright