Opened 3 years ago

Closed 4 months ago

#1843 closed defect (fixed)

$upstream_http_set_cookie includes only first cookie

Reported by: Jiri Mihal Owned by:
Priority: major Milestone:
Component: nginx-module Version: 1.16.x
Keywords: ngx_http_upstream_module Cc:
uname -a: Linux localhost 5.1.17-x86_64-linode128 #1 SMP PREEMPT Wed Jul 10 17:11:49 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
nginx -V: nginx version: nginx/1.16.1
built by gcc 7.4.0 (Ubuntu 7.4.0-1ubuntu1~18.04.1)
built with OpenSSL 1.1.1 11 Sep 2018
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-g -O2 -fdebug-prefix-map=/data/builder/debuild/nginx-1.16.1/debian/debuild-base/nginx-1.16.1=. -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC' --with-ld-opt='-Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie'

Description

server {
        listen 80 default_server;
        listen [::]:80 default_server;
        resolver 1.1.1.1;

        location / {
                # http://www.mihal.me/redirect.php sets 3 cookies and redirects a user
                # setcookie('moo', 'boo', time() + 3600); setcookie('boo', 'bar', time() + 3600); setcookie('aaa', 'uuu', time() + 3600); header('Location: http://www.mihal.me/dest.php');
                proxy_pass http://www.mihal.me/redirect.php;
                proxy_intercept_errors on;
                error_page 301 302 307 = @proxy_redirect;
        }

        location @proxy_redirect {
                set $saved_http_set_cookie $upstream_http_set_cookie;
                set $my_uri http://$server_addr/proxy-dest;
                proxy_set_header X-Cookie $saved_http_set_cookie;
                proxy_pass $my_uri;
        }

        location /proxy-dest {
                # Unfortunately X-Cookie contains only first cookie
                add_header X-Cookie $http_x_cookie;
                return 200;
        }
}

Change History (4)

comment:1 by Jiri Mihal, 3 years ago

I just tried version nginx/1.17.3 and bug is still present.

comment:2 by bgardner.noggin.com.au@…, 23 months ago

This is still present in 1.17.4

comment:3 by Maxim Dounin <mdounin@…>, 4 months ago

In 8023:08b3ea81ff5f/nginx:

Combining unknown headers during variables lookup (ticket #1316).

Previously, $http_*, $sent_http_*, $sent_trailer_*, $upstream_http_*,
and $upstream_trailer_* variables returned only the first header (with
a few specially handled exceptions: $http_cookie, $http_x_forwarded_for,
$sent_http_cache_control, $sent_http_link).

With this change, all headers are returned, combined together. For
example, $http_foo variable will be "a, b" if there are "Foo: a" and
"Foo: b" headers in the request.

Note that $upstream_http_set_cookie will also return all "Set-Cookie"
headers (ticket #1843), though this might not be what one want, since
the "Set-Cookie" header does not follow the list syntax (see RFC 7230,
section 3.2.2).

comment:4 by Maxim Dounin, 4 months ago

Resolution: fixed
Status: newclosed

Fixed, thanks to all involved.

Note: See TracTickets for help on using tickets.