Skip to content

Update cookie handling to align with rfc6265 specifications #1056

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jonife merged 8 commits into from
Oct 8, 2024
Merged

Update cookie handling to align with rfc6265 specifications #1056

Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
9f61d50
Add unit test to verify cookie behavior with Max-Age=0
leekib Sep 22, 2024
3a72095
Add Servlet request tests to validate RFC 6265 cookie compliance
leekib Sep 22, 2024
c04fd13
feat: Introduce CookieProcessor interface and refactor cookie handling
leekib Sep 22, 2024
df1b787
Merge branch 'aws:main' into main
leekib Sep 22, 2024
22bf190
refactor: Use `java.time` API for thread-safe cookie expiration handling
leekib Sep 23, 2024
4ab26c7
refactor: Remove redundant check in cookie character validation
leekib Sep 23, 2024
1770cca
refactor: added helper methods to simplify cookie attribute appending.
leekib Sep 27, 2024
dfcc006
refactor: replaced StringBuffer with StringBuilder.
leekib Sep 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
refactor: added helper methods to simplify cookie attribute appending.
  • Loading branch information
@leekib
leekib committed Sep 27, 2024
commit 1770ccac825810476865ae4445cdb808fe667b9c
46 changes: 26 additions & 20 deletions ...ore/src/main/java/com/amazonaws/serverless/proxy/internal/servlet/AwsCookieProcessor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ public class AwsCookieProcessor implements CookieProcessor {
// Cookie attribute constants
static final String COOKIE_COMMENT_ATTR = "Comment";
static final String COOKIE_DOMAIN_ATTR = "Domain";
static final String COOKIE_EXPIRES_ATTR = "Expires";
static final String COOKIE_MAX_AGE_ATTR = "Max-Age";
static final String COOKIE_PATH_ATTR = "Path";
static final String COOKIE_SECURE_ATTR = "Secure";
Expand Down Expand Up @@ -114,53 +115,61 @@ public String generateHeader(Cookie cookie) {
}

int maxAge = cookie.getMaxAge();
if (maxAge > -1) {
header.append("; Expires=");
if (maxAge == 0) {
header.append(ANCIENT_DATE);
} else {
Instant expiresAt = Instant.now().plusSeconds(maxAge);
header.append(COOKIE_DATE_FORMATTER.format(expiresAt));
header.append("; Max-Age=").append(maxAge);
}
if (maxAge == 0) {
appendAttribute(header, COOKIE_EXPIRES_ATTR, ANCIENT_DATE);
} else if (maxAge > 0){
Instant expiresAt = Instant.now().plusSeconds(maxAge);
appendAttribute(header, COOKIE_EXPIRES_ATTR, COOKIE_DATE_FORMATTER.format(expiresAt));
appendAttribute(header, COOKIE_MAX_AGE_ATTR, String.valueOf(maxAge));
}

String domain = cookie.getDomain();
if (domain != null && !domain.isEmpty()) {
validateDomain(domain);
header.append("; Domain=").append(domain);
appendAttribute(header, COOKIE_DOMAIN_ATTR, domain);
}

String path = cookie.getPath();
if (path != null && !path.isEmpty()) {
validatePath(path);
header.append("; Path=").append(path);
appendAttribute(header, COOKIE_PATH_ATTR, path);
}

if (cookie.getSecure()) {
header.append("; Secure");
appendAttributeWithoutValue(header, COOKIE_SECURE_ATTR);
}

if (cookie.isHttpOnly()) {
header.append("; HttpOnly");
appendAttributeWithoutValue(header, COOKIE_HTTP_ONLY_ATTR);
}

String sameSite = cookie.getAttribute(COOKIE_SAME_SITE_ATTR);
if (sameSite != null) {
header.append("; SameSite=").append(sameSite);
appendAttribute(header, COOKIE_SAME_SITE_ATTR, sameSite);
}

String partitioned = cookie.getAttribute(COOKIE_PARTITIONED_ATTR);
if (EMPTY_STRING.equals(partitioned)) {
header.append("; Partitioned");
appendAttributeWithoutValue(header, COOKIE_PARTITIONED_ATTR);
}

addAdditionalAttributes(cookie, header);

return header.toString();
}

private void addAdditionalAttributes(Cookie cookie, StringBuffer header) {
private void appendAttribute(StringBuilder header, String name, String value) {
header.append("; ").append(name);
if (!EMPTY_STRING.equals(value)) {
header.append('=').append(value);
}
}

private void appendAttributeWithoutValue(StringBuilder header, String name) {
header.append("; ").append(name);
}

private void addAdditionalAttributes(Cookie cookie, StringBuilder header) {
for (Map.Entry<String, String> entry : cookie.getAttributes().entrySet()) {
switch (entry.getKey()) {
case COOKIE_COMMENT_ATTR:
Expand All @@ -175,10 +184,7 @@ private void addAdditionalAttributes(Cookie cookie, StringBuffer header) {
break;
default:
validateAttribute(entry.getKey(), entry.getValue());
header.append("; ").append(entry.getKey());
if (!EMPTY_STRING.equals(entry.getValue())) {
header.append('=').append(entry.getValue());
}
appendAttribute(header, entry.getKey(), entry.getValue());
break;
}
}
Expand Down