New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Don't expire cookie with later setting in the same headers #1584

Open

agriffis wants to merge 1 commit into httpie:master from agriffis:dont_expire_cookies_with_later_setting

agriffis commented Jun 26, 2024 •

edited

Loading

I'm interacting with a server that likes to simultaneously expire a cookie and give it a new value in the same headers:

Set-Cookie: JSESSIONID=expire; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: JSESSIONID=ED0E0934E642AC44A7ACDE6CED16D904; Path=/; Secure; HttpOnly

This isn't spec, as I understand it, but it turns out the browsers don't care. They just use the last value given.

So this PR updates httpie to behave in the same way, by ignoring an earlier expiration in favor of a later setting in the same headers.

Without this change, httpie drops the cookie rather than setting it, which makes interacting with this particular server quite difficult.


          Don't expire cookie with later setting in the same headers

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet