[assertions] allow cookie-attributes matched in case-insensitive

[thePanz]

What is the current bug behavior?

My server answers with the following:

    set-cookie: PHPSESSID=7f79194ea0bbd7f54b8a7da0a8d4d5b6; path=/; secure; httponly; samesite=lax

But the assertions

[Asserts]
cookie "PHPSESSID[Secure]" exists
cookie "PHPSESSID[HttpOnly]" exists

fails with:

   | cookie "PHPSESSID[Secure]" exists
   |   actual:   none
   |   expected: something

What is the expected correct behavior?

Allow to match on the secure attribute too (case insensitive)

Execution context

• Hurl Version (hurl --version): hurl 5.0.1 (x86_64-pc-linux-gnu) libcurl/8.10.1 OpenSSL/3.3.2 zlib/1.3.1 brotli/1.1.0 zstd/1.5.6 libidn2/2.3.7 libssh2/1.11.0 nghttp2/1.63.0 quic/nghttp3/1.5.0 Features (libcurl): alt-svc AsynchDNS brotli HSTS HTTP2 HTTP3 IDN IPv6 Largefile libz NTLM SPNEGO SSL TLS-SRP UnixSockets zstd Features (built-in): brotli

Possible fixes

Allow of case-insnsitive maches on the attribues? :shrug:
Not sure if the HTTP specs require to handle the attributes in a case-sensitive way, could not find any precise documentation for that

[jcamiel]

Hi @thePanz

According to RFC6265, attribute name should be treated case-insensitively:

If the attribute-name case-insensitively matches the string "Secure", the user agent MUST append an attribute to the cookie-attribute-list with an attribute-name of Secure and an empty attribute-value.

I think we should follow the spec and fix the actual behavior. Thanks for the issue!

[fabricereix]

Yes @thePanz, you are right, our cookie attribute query should be case-incentive to match the spec above and to be consistent with the browser.

I have tested the following response headers in Firefox

Set-Cookie: CamelCase=Value; Max-Age=1000; HttpOnly
Set-Cookie: lowercase=value; max-age=1000; httponly
Set-Cookie: UPPERCASE=VALUE; MAX-AGE-age=1000; HTTPONLY

The 3 of them have the same expiration and the HttpOnly attribute set to true.

[fabricereix]

We can also note that we have already supported the case-insensitivity of the cookie attribute in the Hurl file:

The 2 queries below are equivalent:

cookie "CamelCase[HttpOnly]" exists
cookie "CamelCase[httponly]" exists