Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix parse cookie #81

Closed
wants to merge 3 commits into from
Closed

Conversation

huadong
Copy link

@huadong huadong commented Feb 15, 2020

当cookie的key=value不是第一项时候,存在bug。比如:cookie: 'max-age=1; ooo=hhh'。
同时对于value值,调用decodeURIComponent进行解码。

@JuneAndGreen
Copy link
Collaborator

JuneAndGreen commented Feb 17, 2020

document.cookie 设置时,会将第一项识别为 key=value,比如 document.cookie = 'max-age=1; ooo=hhh',浏览器会将 max-age 识别为 key ,所以此处使用第一项作为 key-value 对,主要是为了对齐浏览器的这个特性。

@huadong
Copy link
Author

huadong commented Feb 19, 2020

对齐浏览器其实没啥问题,Axios也是这么识别的。
主要是企鹅的API老出bug。有时候一些版本会出现第一项不是key=value。

@huadong
Copy link
Author

huadong commented Feb 19, 2020

从规范来说,你是对的,把第一个cookie-pair看作key-value。

COOKIE RFC

4.1.1. Syntax

Informally, the Set-Cookie response header contains the header name
"Set-Cookie" followed by a ":" and a cookie. Each cookie begins with
a name-value-pair, followed by zero or more attribute-value pairs.
Servers SHOULD NOT send Set-Cookie headers that fail to conform to
the following grammar:

set-cookie-header = "Set-Cookie:" SP set-cookie-string
set-cookie-string = cookie-pair *( ";" SP cookie-av )
cookie-pair = cookie-name "=" cookie-value
cookie-name = token
cookie-value = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
; US-ASCII characters excluding CTLs,
; whitespace DQUOTE, comma, semicolon,
; and backslash
token = <token, defined in [RFC2616], Section 2.2>

cookie-av = expires-av / max-age-av / domain-av /
path-av / secure-av / httponly-av /
extension-av
expires-av = "Expires=" sane-cookie-date
sane-cookie-date = <rfc1123-date, defined in [RFC2616], Section 3.3.1>
max-age-av = "Max-Age=" non-zero-digit *DIGIT
; In practice, both expires-av and max-age-av
; are limited to dates representable by the
; user agent.
non-zero-digit = %x31-39
; digits 1 through 9
domain-av = "Domain=" domain-value
domain-value =
; defined in [RFC1034], Section 3.5, as
; enhanced by [RFC1123], Section 2.1
path-av = "Path=" path-value
path-value = <any CHAR except CTLs or ";">
secure-av = "Secure"
httponly-av = "HttpOnly"
extension-av = <any CHAR except CTLs or ";">

@huadong huadong closed this Feb 19, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants