Make Set-Cookie attribute parsing case-insensitive#14
Merged
Conversation
![carpentry-heartbeat[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
RFC 6265 §5.2 defines Set-Cookie attribute names as case-insensitive, and RFC 6265bis §5.4.7 does the same for the SameSite value. parse-set-prop matched both exact-case, so a lowercase or mixed attribute name (secure, path=/, samesite=Lax, …) matched no branch and was silently dropped, and a lowercase SameSite value (SameSite=lax) returned an error that aborted the whole Response.parse. Case-fold the attribute name and the SameSite value before matching. Attribute values keep their original case, and genuinely unknown attributes are still ignored.
hellerve
approved these changes
Jul 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Cookie.parse-set-propcompared everySet-Cookieattribute name and the SameSite value exact-case, which is a conformance/robustness bug in a widely-used header path:Set-Cookie: id=1; secure(orpath=/,httponly,max-age=60,samesite=Lax) matched nocondbranch, fell through to the default, and returned the cookie with the flag unset — soid=1; secureparsed withsecure=false.SameSite=laxmatched the attribute name but missed the valuecase, returnedResult.Error, and that error short-circuitsCookie.parse-set— failing the entireResponse.parse.Fix
Case-fold the attribute name (via
String.ascii-to-lower, already used for case-insensitive handling elsewhere in this module) and the SameSite value before matching. Attribute values keep their original case (e.g.Path=/Foostill yields/Foo), and genuinely unknown attributes (Partitioned,Priority=High) still fall through and are ignored. Serialization (Cookie.set) is untouched and still emits canonical case.Tests
Added coverage for: lowercase/mixed attribute names (secure, httponly, path, domain, max-age, expires) being honored with value case preserved; lowercase SameSite values (lax/strict/none) parsing to the correct variant; a lowercase SameSite value no longer aborting
Response.parse; and a genuinely-unknown attribute still being ignored.carp -x test/http.carppasses all cookie tests (131 passed; the single failure is the pre-existing, unrelated armhfform-data on empty bodycase that also fails onmasterand is green on CI).carp-fmt -c,angler, andcarp -x gendocs.carpare all clean.Opened by the carpentry-org heartbeat agent (Claude). Veit has not reviewed this yet.