Opened 5 years ago

Last modified 5 years ago

#1843 new defect

$upstream_http_set_cookie includes only first cookie

Reported by: Jiri Mihal Owned by:
Priority: major Milestone:
Component: nginx-module Version: 1.16.x
Keywords: ngx_http_upstream_module Cc:
uname -a: Linux localhost 5.1.17-x86_64-linode128 #1 SMP PREEMPT Wed Jul 10 17:11:49 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
nginx -V: nginx version: nginx/1.16.1
built by gcc 7.4.0 (Ubuntu 7.4.0-1ubuntu1~18.04.1)
built with OpenSSL 1.1.1 11 Sep 2018
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-g -O2 -fdebug-prefix-map=/data/builder/debuild/nginx-1.16.1/debian/debuild-base/nginx-1.16.1=. -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC' --with-ld-opt='-Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie'

Description 

server {
        listen 80 default_server;
        listen [::]:80 default_server;
        resolver 1.1.1.1;

        location / {
                # http://www.mihal.me/redirect.php sets 3 cookies and redirects a user
                # setcookie('moo', 'boo', time() + 3600); setcookie('boo', 'bar', time() + 3600); setcookie('aaa', 'uuu', time() + 3600); header('Location: http://www.mihal.me/dest.php');
                proxy_pass http://www.mihal.me/redirect.php;
                proxy_intercept_errors on;
                error_page 301 302 307 = @proxy_redirect;
        }

        location @proxy_redirect {
                set $saved_http_set_cookie $upstream_http_set_cookie;
                set $my_uri http://$server_addr/proxy-dest;
                proxy_set_header X-Cookie $saved_http_set_cookie;
                proxy_pass $my_uri;
        }

        location /proxy-dest {
                # Unfortunately X-Cookie contains only first cookie
                add_header X-Cookie $http_x_cookie;
                return 200;
        }
}

Change History (1)

comment:1 by Jiri Mihal, 5 years ago

I just tried version nginx/1.17.3 and bug is still present.

Note: See TracTickets for help on using tickets.