mccutchen / go-httpbin

A reasonably complete and well-tested golang port of httpbin, with zero dependencies outside the go stdlib.
https://httpbingo.org
MIT License
596 stars 124 forks source link

httpbin doesn't delete cookies #171

Closed joshuawhite929 closed 8 months ago

joshuawhite929 commented 8 months ago

The cookie created using cookies/set?foo=bar isn't deleted by calling cookies/delete?foo

mccutchen commented 8 months ago

How are you testing this? On my end, deleting cookies appears to work correctly in both curl and Firefox.

mccutchen commented 8 months ago

For completeness, here's a transcript of trying to reproduce this report using curl, in case it helps. Please let me know if I'm missing something!


1. Start with empty cookie jar:

$ touch cookies.txt; cat cookies.txt
$

2. Set foo=bar cookie

$ curl --http1.1 -v -c cookies.txt -b cookies.txt 'https://httpbingo.org/cookies/set?foo=bar' 2>&1 | grep -i cookie
> GET /cookies/set?foo=bar HTTP/1.1
< location: /cookies
* Added cookie foo="bar" for domain httpbingo.org, path /cookies/, expire 0
< set-cookie: foo=bar; HttpOnly

Now present in cookie jar, as expected:

$ cat cookies.txt 
# Netscape HTTP Cookie File
# https://curl.se/docs/http-cookies.html
# This file was generated by libcurl! Edit at your own risk.

#HttpOnly_httpbingo.org FALSE   /cookies/   FALSE   0   foo bar

3. Ensure go-httpin sees the same foo=bar cookie that was just set

$ curl --http1.1 -c cookies.txt -b cookies.txt 'https://httpbingo.org/cookies' 
{
  "foo": "bar"
}

Cookie still present in cookie jar:

$ cat cookies.txt 
# Netscape HTTP Cookie File
# https://curl.se/docs/http-cookies.html
# This file was generated by libcurl! Edit at your own risk.

#HttpOnly_httpbingo.org FALSE   /cookies/   FALSE   0   foo bar

4. Delete foo cookie

$ curl --http1.1 -v -c cookies.txt -b cookies.txt 'https://httpbingo.org/cookies/delete?foo' 2>&1 | grep -i cookie
> GET /cookies/delete?foo HTTP/1.1
> Cookie: foo=bar
< location: /cookies
* Replaced cookie foo="" for domain httpbingo.org, path /cookies/, expire 1
< set-cookie: foo=; Expires=Fri, 17 Mar 2023 18:16:05 GMT; Max-Age=0; HttpOnly

Cookie no longer in cookie jar:

$ cat cookies.txt 
# Netscape HTTP Cookie File
# https://curl.se/docs/http-cookies.html
# This file was generated by libcurl! Edit at your own risk.
joshuawhite929 commented 8 months ago

Apologies, this was a browser plugin issue.