[11.x] Fix Cookie::queue to support domain-specific cookies #53202
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR addresses the issue where setting two cookies using
Cookie::queue(...)
with the same name and path but different domains results in only one cookie being sent to the client, as the latter overwrites the prior. The issue is detailed in #53159.Problem Description
The issue arises from how
CookieJar
currently stores queued cookies, only considering the cookie's name and path while ignoring the domain. TheSymfony ResponseHeaderBag::setCookie()
method, on the other hand, correctly differentiates cookies by domain in addition to name and path.Solution
This PR updates
CookieJar
to take domains into account when queuing cookies. Specifically:queue
method now stores queued cookies using the cookie's name, path, and domain as keys, ensuring cookies with the same name and path but different domains do not overwrite each other.Testing
secure
,httpOnly
, and other attributes.