Different cookies in later requests overwrite first cookie

[kjg]

When I make multiple requests to a service the cookie set in the first request is overwritten by different cookies in subsequent requests even through the subsequent cookies have different names.

It seems that the problem is this line https://github.com/rubiii/savon/blob/master/lib/savon/client.rb#L94 where the entire cookie header is overwritten when a new Set-Cookie header is detected

def set_cookie(headers)
  http.headers["Cookie"] = headers["Set-Cookie"] if headers["Set-Cookie"]
end

[kjg]

Here is a fix for this. I'll have time to create a proper pull-request including specs in a few days if no one else does it before then.

def set_cookie(headers)
  if headers["Set-Cookie"]
    @cookies ||= {}
    #handle single or multiple Set-Cookie Headers as returned by Rack::Utils::HeaderHash in HTTPI
    set_cookies = [headers["Set-Cookie"]].flatten 
    set_cookies.each do |set_cookie|
      # use the cookie name as the key to the hash to allow for cookie updates and seperation
      # set the value to name=value (for easy joining), stopping when we hit the Cookie options
      @cookies[set_cookie.split('=').first] = set_cookie.split(';').first
    end

    http.headers["Cookie"] = @cookies.values.join(';')
  end
end

[rubiii]

if you could create a pull requests (with tests), i'll make sure to fix this.

[kjg]

Are you still planning on pulling this in?

[rubiii]

merged. thank you very much!

[ruby2day]

Hmmm I still cant get more than one Set-Cookie . An api im consuming using savon sends back 2 "Set-Cookie" values, and only the last is set in the header response. I thought that multiple values of the same cookie name would be stored in an array for access?

I can see the two cookies coming over the wire from the api response, but i can only get the last value. supwitdat

[sbu]

I have the same problem, I only get one cookie. More details at: https://groups.google.com/forum/#!topic/savonrb/fOAJYIWCj8M

[rubiii]

version 2 i guess?

[sbu]

Yes, version 2.0.2.

[rubiii]

i'll try to come up with a spec to verify the problem later today.
if someone else has the time to help out, there's already a cookie spec
which should be pretty easy to reuse for multiple cookies:

https://github.com/savonrb/savon/blob/master/spec/savon/client_spec.rb#L98

[rubiii]

i need more information to debug this. could you please double-check and paste the output of:

response.http.headers["Set-Cookies"]

also this might be interesting as well:

response.http.cookies

plus which httpi adapter are you using and could you try another one to isolate the problem?

[sbu]

response.http.headers["Set-Cookies"]
=> nil

response.http.headers["set-cookie"]({KEY} instead of real value for security reasons)
=> "ASP.NET_SessionId={KEY}; path=/; HttpOnly"

response.http.cookies ({KEY} instead of real value for security reasons)
=> [#<HTTPI::Cookie:0x007ffc26081a90 @cookie="ASP.NET_SessionId={KEY}; path=/; HttpOnly">]

Using httpi 2.0.0 (automatically installed as a dependence of savon 2.0.2)

.ASPXAUTH is missing, it is returned in the header of the response if the request is issued by SoapUI

[sbu]

If I issue the request twice (using Savon), then the second response contains the .ASPXAUTH cookie ... strange ...

[rogerleite]

@rubiii i think this is a bug from httpi, and this pull request savonrb/httpi@4ebba6d fix it, returning cookies as Array when is more than one. We have to check if savon won't break in this case.

This fix was after releasing httpi 2.0.0.

[rubiii]

@rogerleite thanks! unfortunately httpi master has lots of changes (we should discuss how and when to release them).
i'll try to integrate the pull request with v2.0.0 for this problem.

[rogerleite]

@rubiii we can checkout v2.0.0 tag, apply the commit and release httpi v2.0.1

[rubiii]

@rogerleite yep, savon seems to work fine with your change. just not sure about #363 right now.

[rubiii]

applied the commit and released v2.0.1. let me know if this fixes the problem.

[rubiii]

savon 2.1 will depend on httpi 2.0.2 which contains the fix for this problem.
@ruby2day @sbu please test against master to make sure this is fixed.

[rubiii]

released v2.1.0. please refer to the updated changelog and documentation for details. let me know how it works!