Multiple cookies with same name are not supported

[jerseyrobot]

It's possible to have multiple cookies with the same name in the cookie header (e.g. cookies in subdomains/subpaths). So, the following is a valid header:
Cookie:"token=val1; token=val2".

However, org.glassfish.jersey.server.ContainerRequest.getCookies returns a Map<String, Cookie>, indicating that it returns only one cookie per name. It calls HttpRequestHeader.readCookies which in turn calls CookieParser.parseCookies. The implementation of parseCookies makes it clear that for multiple cookies with the same name, the last one is returned in the map.

Environment

Server

Affected Versions

[2.22]

[jerseyrobot]

@glassfishrobot Commented
Reported by sshukla

[jerseyrobot]

@glassfishrobot Commented
This issue was imported from java.net JIRA JERSEY-3161

[jerseyrobot]

• Issue Imported From: https://github.com/jersey/jersey/issues/3433
• Original Issue Raised By:@glassfishrobot
• Original Issue Assigned To: @mpotociar

[glitchcube]

Hi,
I have recently got the same issue. The problem occurred when we used Springs CSRF-protection. Spring security sends two cookies with the name XSRF-TOKEN in the set-cookies. One with Expires/Max-age set to 0 and the other one with Expire/Max-age set to Session.

All major browsers seems to always pick the cookie with Expire/Max-age set to Session. But when I try to use the method below it returnes the cookies which has expired.

org.glassfish.jersey.client.InboundJaxrsResponse#getCookies

[jansupol]

RFC 6265 Section 5.4 defines that:

The user agent SHOULD sort the cookie-list in the following
order:

  *  Cookies with longer paths are listed before cookies with
     shorter paths.

  *  Among cookies that have equal-length path fields, cookies with
     earlier creation-times are listed before cookies with later
     creation-times.

SHOULD is not MUST, so technically not a bug. But I agree Jersey SHOULD do what is recommended.

[jansupol]

ContainerRequest.getCookies() inherits from HttpHeaders.getCookies, so we cannot change the return type to return multiple cookies with the same name.

[glitchcube]

You got a really good point, @jansupol. If we could have sorted the cookies in the recommended order, this should solve the problem.
Is this something that can be done?

Thanks for the fast feedback!