search

Happstack / happstack-server

An HTTP Server
BSD 3-Clause "New" or "Revised" License
84 stars 28 forks source link

Cookie names should be case-sensitive #78

Open zlondrej opened 12 months ago

zlondrej commented 12 months ago

rqCookies and Cookie records contains lowercase name of the cookie. But browsers treat the cookie names in case-sensitive manner. It's easy for server to make the cookie lookup case-insensitive when cookies have correct letter cases by using lower, upper or any kind of case-insensitive comparison. But it's not possible to fill in the correct letter cases when the cookie name is lowercased.

The issue seems to stem from this line: https://github.com/Happstack/happstack-server/blob/master/src/Happstack/Server/Internal/Cookie.hs#L173

return $ Cookie ver path domain (low name) val False False SameSiteNoValue

Meanwhile, mkCookieHeader preserves the letter casing in the Set-Cookie header, which makes it more inconsistent.