Last set-cookie headers on a page overwrites the ones before

[erikthorselius]

If a homepage has multiple set-cookes headers it is only the last set-cookie is in the response :header map.

[borkdude]

@erikthorselius Can you give a more concrete example which allows us to repro/test and fix the problem?

[borkdude]

I guess the problem happens here:

babashka.curl/src/babashka/curl.clj

Line 202 in 5e8daab

[status (assoc parsed-headers (str/lower-case k) (str/trim v))]

Should we instead of creating a map, create a seq of map-entries/vectors? It will be a breaking change, but maybe for the good? Let's investigate how other clients do this (e.g. clj-http).

/cc @lispyclouds

[borkdude]

clj-http-lite:

https://github.com/clj-commons/clj-http-lite/blob/6b53000df55ac05c4ff8e5047a5323fc08a52e8b/src/clj_http/lite/core.clj#L10-L15

If a name appears more than once (like set-cookie) then the value
will be a vector containing the values in the order they appeared
in the headers.

[borkdude]

Hato:

https://github.com/gnarroway/hato/blob/7e69c7cf80635fb94c90627daaedb5c8a5584ad0/src/hato/client.clj#L155

Not sure what it does there...

[borkdude]

clj-http, same as clj-http-lite:

https://github.com/dakrone/clj-http/blob/5f0f842f330201cdfbeedcde781bb62cbdd018b8/src/clj_http/core.clj#L33-L35

I guess we would be safe doing the same as people should already be relatively used to this behavior and we would not break anything.

[borkdude]

I guess httpkit has the same bug:

https://github.com/http-kit/http-kit/blob/9eac670a71f390a9e988deddfcf3203fa0970de7/src/org/httpkit/client.clj#L34

[borkdude]

Let's go ahead with the clj-http/lite approach.

[erikthorselius]

Wow you are fast!

Sorry for my short description and it looks like you figured it out. I tried to get a session cookie from the headers but it was only one set-cookie header in the headers map. But if I curl the page directly it was two set-cookie headers and the session was the first so it was overwritten by the second.

[lispyclouds]

Sounds good to me too! Would be consistent with the query params impl now 😄

[borkdude]

Would be consistent with the query params impl now

How's that?

[lispyclouds]

Ah yeah I misread the clj-http impl as the way we handle the same named query params by passing a vector of vectors. But now that I read it again its different. Also this is about the response headers not the request ones.