[HTTPCLIENT-1788] Cookies for paths that are no prefix of the uri path are rejected (using CookieSpec Standard)

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 4.5.2
• Fix Version/s: 4.5.3, 5.0 Alpha2
• Assignee: Unassigned
• Reporter: Ole SH
• Created: 28/Nov/16 08:16
• Updated: 13/Mar/17 11:00
• Resolved: 13/Jan/17 18:52

Description

Using CookieSpec Standard if a response to a http request to http://.../abc contains a cookie for the path /def this cookie is rejected by httpclient. This is the correct behavior in case of RFC 2109 (cf. HTTPCLIENT-1043). But RFC 6265 (as far as I know) does not state that a cookie path must be a prefix of the request uri path. In 8.6 it is even mentioned as a "security problem" that 'an HTTP response to a request for http://example.com/foo/bar can set a cookie with a Path attribute of "/qux"'.

I know that I can workaround my problem by using a custom cookie policy. I just wondered if this behavior of httpclient is correct with respect to RFC 6265.

cf. http://mail-archives.apache.org/mod_mbox/hc-httpclient-users/201611.mbox/[e-mail]%3E