Skip to content

HTTPCookie Constructor Fails to Handle Discard Attribute Properly #4664

@secharvet

Description

@secharvet

Describe the bug
The HTTPCookie constructor in POCO fails to correctly handle the Discard attribute in HTTP Set-Cookie headers. Instead of recognizing Discard as an attribute, it incorrectly assigns it as the name of the cookie with an empty value, leading to the loss of the actual cookie data.

To Reproduce
You can reproduce this beahvior with a cookie formed like below (Discard token in cookie-av):
unitoken="{AES-256}/exampletoken="; Version=1; Path=/examplePath; Discard; HttpOnly

Expected behavior
Discard should be treated as an attribute of the cookie, not as the cookie name.

** Proposed Solution:**
Add a condition to handle Discard in the constructor similarly to how Secure and HttpOnly are handled.

** Environment:**

  • POCO version: head version
  • Operating System: Linux /Windows

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

Status

Done

Relationships

None yet

Development

No branches or pull requests

Issue actions