Skip to content

WebTestClientRequestConverter mishandles Cookie headers with multiple cookies or a cookie without = - #1076

Open
chuuminggg wants to merge 1 commit into
spring-projects:4.0.xfrom
chuuminggg:n3-cookie-header-parsing
Open

chuuminggg wants to merge 1 commit into
spring-projects:4.0.xfrom
chuuminggg:n3-cookie-header-parsing

Conversation

@chuuminggg

@chuuminggg chuuminggg commented Oct 15, 2026 •

Copy link
Copy Markdown
Contributor

This is a follow-up to #1038 / #1040. WebTestClientRequestConverter still mishandles two kinds of Cookie header:

  1. A header that contains multiple cookies, as user agents send them (RFC 6265 §5.4), is converted to a single cookie:

    .header(HttpHeaders.COOKIE, "cookieName1=cookieVal1; cookieName2=cookieVal2")

    produces one cookie named cookieName1 with the value cookieVal1; cookieName2=cookieVal2. Using .cookie(name, value) twice works, as each cookie is in a separate header value.

  2. A cookie without = fails the conversion:

    .header(HttpHeaders.COOKIE, "cookieName")
    java.lang.StringIndexOutOfBoundsException: Range [0, -1) out of bounds for length 10
    	at org.springframework.restdocs.webtestclient.WebTestClientRequestConverter.createRequestCookie(WebTestClientRequestConverter.java:108)
    

    WebTestClientRequestConverter mishandles cookies whose value contains = and crashes on cookie headers without = #1038 described this case, and WebTestClientRequestConverter mishandles cookies whose value contains = #1040 mentioned handling it by returning an empty value, but the fix that was merged only changed the exception from an ArrayIndexOutOfBoundsException to a StringIndexOutOfBoundsException.

This PR splits each Cookie header value on "; ", in the same way as RestTestClientRequestConverter in main. A cookie without = is converted to a cookie with that name and an empty value. I'm happy to change this to skip the cookie or to throw a clearer exception if you prefer.

The main branch's RestTestClientRequestConverter already splits on "; ", but it has the same createRequestCookie method, so a cookie without = fails there as well. It isn't in 4.0.x, so this PR doesn't change it. It may need the same change when merging forward.

@wilkinsona

Copy link
Copy Markdown
Member

Thanks, @chuuminggg. 3.0.x is no longer supported. Can you please update your PR to use 4.0.x as its base branch?

@chuuminggg
chuuminggg force-pushed the n3-cookie-header-parsing branch from b04e4f8 to 1d527bd Compare October 15, 2026 23:22
@chuuminggg
chuuminggg changed the base branch from 3.0.x to 4.0.x October 15, 2026 23:23
Previously, WebTestClientRequestConverter converted a Cookie header
containing multiple cookies into a single cookie and failed with a
StringIndexOutOfBoundsException when a cookie had no =. Each header
value is now split on '; ' and a cookie without = is converted to a
cookie with an empty value.

Signed-off-by: chuuminggg <rorrxr@naver.com>
@chuuminggg
chuuminggg force-pushed the n3-cookie-header-parsing branch from 1d527bd to 4c10317 Compare October 16, 2026 00:46
@chuuminggg

Copy link
Copy Markdown
Contributor Author

I've rebased the PR onto 4.0.x and changed its base branch. The tests have also been updated to use JUnit 5 to match the 4.0.x conventions.

@chuuminggg
chuuminggg force-pushed the n3-cookie-header-parsing branch from 2c6873f to 4c10317 Compare October 16, 2026 10:36
@wilkinsona wilkinsona added type: bug A bug and removed status: waiting-for-triage Untriaged issue labels Oct 19, 2026
@wilkinsona wilkinsona added this to the 4.0.x milestone Oct 19, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants