Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
MIME-Version: 1.0
In-Reply-To: <AB1691BE05AE7F4992697F2A0835627ACA0AC484@VOEXM10W.internal.vodafone.com>
References: <CAN-a7TEXN92AbpRAsNWJP9YTFZXekmECc2NYp_L0UYu=1ycZvw@mail.gmail.com>
 <AB1691BE05AE7F4992697F2A0835627ACA0AC484@VOEXM10W.internal.vodafone.com>
From: Yann Ylavic <ylavic.dev@gmail.com>
Date: Wed, 29 Jun 2016 10:27:53 +0200
Message-ID: <CAKQ1sVP3T9VaA4XisJ-f-9LhWxxaLQVWFRN64QtT6caPKD-vKQ@mail.gmail.com>
Subject: Re: Mergine of Multiple Cookie Headers
To: httpd-dev <dev@httpd.apache.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
archived-at: Wed, 29 Jun 2016 08:28:06 -0000

On Wed, Jun 29, 2016 at 9:33 AM, Pl=C3=BCm, R=C3=BCdiger, Vodafone Group
<ruediger.pluem@vodafone.com> wrote:
>
>
>> -----Original Message-----
>> From: Rainer Canavan [mailto:rainer.canavan@sevenval.com]
>> Sent: Dienstag, 28. Juni 2016 16:30
>> To: dev@httpd.apache.org
>> Subject: Mergine of Multiple Cookie Headers
>>
>> Hi,
>>
>> We've observed multiple gateways, operated by e.g. AT&T, COLT and
>> Vodafone, that inject additional Cookie: headers into client requests,
>> such as
>>
>> Cookie: actually=3Dfrom_the_client
>> Cookie: Bearer-Type=3Dw-TCP
>> Cookie: network-access-type=3DUMTS
>>
>> Apache httpd merges those headers into a single, comma separated list,
>> and also appends the names and values of all Cookies set in the
>> additional Cookie Headers to the value of the last Cookie of the first
>> header. This can be seeen by logging  %{actually}C for the example
>> above, which would contain
>>
>> actually=3Dfrom_the_client, Bearer-Type=3Dw-TCP, network-access-type=3DU=
MTS
>>
>> While RFC 6265 clearly requires that User-Agents send only a single
>> Cookie: request header, I would argue that the Cookie header should be
>> treated as an exception, similar to the Set-Cookie:-response header,
>> and not be merged into a single header field. An alternative would be
>> to use "; " as a separator.
>>
>> Any thoughts?
>
> How about
>
> RequestHeader edit* Cookie ", " "; "

Or possibly something more generic (quoting, escaping...), but less readabl=
e :p

RequestHeader edit* Cookie
([^=3D;,]++)(=3D"(?:[^\\\\"]\\\\.)*+[^"]*+"|[^;,]*)?+[;,] $1$2; early

(with or without the "early" flag)

Regards,
Yann.