Fix cookie handling in recent Cowboy versions

Author: josevalim

lib/plug/cowboy/conn.ex

@@ -30,9 +30,9 @@ defmodule Plug.Cowboy.Conn do
 
   @impl true
   def send_resp(req, status, headers, body) do
-    headers = to_headers_map(headers)
+    req = to_headers_map(req, headers)
     status = Integer.to_string(status) <> " " <> Plug.Conn.Status.reason_phrase(status)
-    req = :cowboy_req.reply(status, headers, body, req)
+    req = :cowboy_req.reply(status, %{}, body, req)
     {:ok, nil, req}
   end
 
@@ -47,15 +47,15 @@ defmodule Plug.Cowboy.Conn do
       end
 
     body = {:sendfile, offset, length, path}
-    headers = to_headers_map(headers)
-    req = :cowboy_req.reply(status, headers, body, req)
+    req = to_headers_map(req, headers)
+    req = :cowboy_req.reply(status, %{}, body, req)
     {:ok, nil, req}
   end
 
   @impl true
   def send_chunked(req, status, headers) do
-    headers = to_headers_map(headers)
-    req = :cowboy_req.stream_reply(status, headers, req)
+    req = to_headers_map(req, headers)
+    req = :cowboy_req.stream_reply(status, %{}, req)
     {:ok, nil, req}
   end
 
@@ -87,7 +87,8 @@ defmodule Plug.Cowboy.Conn do
 
   @impl true
   def inform(req, status, headers) do
-    :cowboy_req.inform(status, to_headers_map(headers), req)
+    req = to_headers_map(req, headers)
+    :cowboy_req.inform(status, %{}, req)
   end
 
   @impl true
@@ -116,7 +117,8 @@ defmodule Plug.Cowboy.Conn do
         {port, _} -> %{port: port}
       end
 
-    :cowboy_req.push(path, to_headers_map(headers), req, opts)
+    req = to_headers_map(req, headers)
+    :cowboy_req.push(path, %{}, req, opts)
   end
 
   @impl true
@@ -143,6 +145,11 @@ defmodule Plug.Cowboy.Conn do
     :maps.to_list(headers)
   end
 
+  defp to_headers_map(req, headers) do
+    headers = to_headers_map(headers)
+    Map.update(req, :resp_headers, headers, &Map.merge(&1, headers))
+  end
+
   defp to_headers_map(headers) when is_list(headers) do
     # Group set-cookie headers into a list for a single `set-cookie`
     # key since cowboy 2 requires headers as a map.

mix.exs

@@ -34,7 +34,7 @@ defmodule Plug.Cowboy.MixProject do
   def deps do
     [
       {:plug, "~> 1.14"},
-      {:cowboy, "~> 2.7.0 or ~> 2.8.0 or ~> 2.9.0 or ~> 2.10.0"},
+      {:cowboy, "~> 2.7"},
       {:cowboy_telemetry, "~> 0.3"},
       {:ex_doc, "~> 0.20", only: :docs},
       {:hackney, "~> 1.2", only: :test},

mix.lock

@@ -1,8 +1,8 @@
 %{
   "certifi": {:hex, :certifi, "2.9.0", "6f2a475689dd47f19fb74334859d460a2dc4e3252a3324bd2111b8f0429e7e21", [:rebar3], [], "hexpm", "266da46bdb06d6c6d35fde799bcb28d36d985d424ad7c08b5bb48f5b5cdd4641"},
-  "cowboy": {:hex, :cowboy, "2.9.0", "865dd8b6607e14cf03282e10e934023a1bd8be6f6bacf921a7e2a96d800cd452", [:make, :rebar3], [{:cowlib, "2.11.0", [hex: :cowlib, repo: "hexpm", optional: false]}, {:ranch, "1.8.0", [hex: :ranch, repo: "hexpm", optional: false]}], "hexpm", "2c729f934b4e1aa149aff882f57c6372c15399a20d54f65c8d67bef583021bde"},
+  "cowboy": {:hex, :cowboy, "2.11.0", "356bf784599cf6f2cdc6ad12fdcfb8413c2d35dab58404cf000e1feaed3f5645", [:make, :rebar3], [{:cowlib, "2.12.1", [hex: :cowlib, repo: "hexpm", optional: false]}, {:ranch, "1.8.0", [hex: :ranch, repo: "hexpm", optional: false]}], "hexpm", "0fa395437f1b0e104e0e00999f39d2ac5f4082ac5049b67a5b6d56ecc31b1403"},
   "cowboy_telemetry": {:hex, :cowboy_telemetry, "0.4.0", "f239f68b588efa7707abce16a84d0d2acf3a0f50571f8bb7f56a15865aae820c", [:rebar3], [{:cowboy, "~> 2.7", [hex: :cowboy, repo: "hexpm", optional: false]}, {:telemetry, "~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "7d98bac1ee4565d31b62d59f8823dfd8356a169e7fcbb83831b8a5397404c9de"},
-  "cowlib": {:hex, :cowlib, "2.11.0", "0b9ff9c346629256c42ebe1eeb769a83c6cb771a6ee5960bd110ab0b9b872063", [:make, :rebar3], [], "hexpm", "2b3e9da0b21c4565751a6d4901c20d1b4cc25cbb7fd50d91d2ab6dd287bc86a9"},
+  "cowlib": {:hex, :cowlib, "2.12.1", "a9fa9a625f1d2025fe6b462cb865881329b5caff8f1854d1cbc9f9533f00e1e1", [:make, :rebar3], [], "hexpm", "163b73f6367a7341b33c794c4e88e7dbfe6498ac42dcd69ef44c5bc5507c8db0"},
   "earmark_parser": {:hex, :earmark_parser, "1.4.39", "424642f8335b05bb9eb611aa1564c148a8ee35c9c8a8bba6e129d51a3e3c6769", [:mix], [], "hexpm", "06553a88d1f1846da9ef066b87b57c6f605552cfbe40d20bd8d59cc6bde41944"},
   "ex_doc": {:hex, :ex_doc, "0.31.1", "8a2355ac42b1cc7b2379da9e40243f2670143721dd50748bf6c3b1184dae2089", [:mix], [{:earmark_parser, "~> 1.4.39", [hex: :earmark_parser, repo: "hexpm", optional: false]}, {:makeup_c, ">= 0.1.1", [hex: :makeup_c, repo: "hexpm", optional: true]}, {:makeup_elixir, "~> 0.14", [hex: :makeup_elixir, repo: "hexpm", optional: false]}, {:makeup_erlang, "~> 0.1", [hex: :makeup_erlang, repo: "hexpm", optional: false]}], "hexpm", "3178c3a407c557d8343479e1ff117a96fd31bafe52a039079593fb0524ef61b0"},
   "hackney": {:hex, :hackney, "1.18.1", "f48bf88f521f2a229fc7bae88cf4f85adc9cd9bcf23b5dc8eb6a1788c662c4f6", [:rebar3], [{:certifi, "~>2.9.0", [hex: :certifi, repo: "hexpm", optional: false]}, {:idna, "~>6.1.0", [hex: :idna, repo: "hexpm", optional: false]}, {:metrics, "~>1.0.0", [hex: :metrics, repo: "hexpm", optional: false]}, {:mimerl, "~>1.1", [hex: :mimerl, repo: "hexpm", optional: false]}, {:parse_trans, "3.3.1", [hex: :parse_trans, repo: "hexpm", optional: false]}, {:ssl_verify_fun, "~>1.1.0", [hex: :ssl_verify_fun, repo: "hexpm", optional: false]}, {:unicode_util_compat, "~>0.7.0", [hex: :unicode_util_compat, repo: "hexpm", optional: false]}], "hexpm", "a4ecdaff44297e9b5894ae499e9a070ea1888c84afdd1fd9b7b2bc384950128e"},

test/plug/cowboy/conn_test.exs

@@ -136,6 +136,20 @@ defmodule Plug.Cowboy.ConnTest do
     assert {200, _, _} = request(:get, "/headers", [{"foo", "bar"}, {"baz", "bat"}])
   end
 
+  def set_cookies(%Conn{} = conn) do
+    conn
+    |> put_resp_cookie("foo", "bar")
+    |> put_resp_cookie("bar", "bat")
+    |> resp(200, conn.request_path)
+  end
+
+  test "set cookies" do
+    assert {200, headers, _} = request(:get, "/set_cookies")
+
+    assert for({"set-cookie", value} <- headers, do: value) ==
+             ["bar=bat; path=/; HttpOnly", "foo=bar; path=/; HttpOnly"]
+  end
+
   def telemetry(conn) do
     Process.sleep(30)
     send_resp(conn, 200, "TELEMETRY")