Skip to content

fix(execute): keep all OAS3 cookie parameters in Cookie header - #4311

Open
HawkForge wants to merge 1 commit into
swagger-api:mainfrom
HawkForge:fix/multiple-cookie-parameters
Open

HawkForge wants to merge 1 commit into
swagger-api:mainfrom
HawkForge:fix/multiple-cookie-parameters

Conversation

@HawkForge

Copy link
Copy Markdown

Description

The OAS3 cookie parameter builder assigned req.headers.Cookie directly for every cookie parameter, so each one overwrote the one before. An operation with two or more cookie parameters only sent the last cookie.

This change adds a small appendCookie helper in src/execute/oas3/parameter-builders.js that joins the new cookie onto any existing Cookie header with ; , the same way execute/index.js already merges req.cookies (for example an apiKey in a cookie) into the header. Both branches of the builder use it: the content branch and the style/explode branch.

Motivation and Context

Fixes #4155. Thanks @mikhuang for the report and for pointing at the exact line.

How Has This Been Tested?

Added a test in test/oas3/execute/style-explode/cookie.js that builds a request with three cookie parameters (a primitive, an exploded array and a content-serialized object) and expects all three in one Cookie header. Without the fix it fails (only c3=... is present); with the fix it passes.

Ran jest on test/oas3/execute and test/execute (all passing), plus eslint and prettier --check on the changed files.

Screenshots (if appropriate):

Types of changes

  • No code changes (changes to documentation, CI, metadata, etc)
  • Dependency changes (any modification to dependencies in package.json)
  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

  • My code follows the code style of this project.
  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.
  • I have added tests to cover my changes.
  • All new and existing tests passed.

Replaces #4291, which got closed when my fork was accidentally detached.

Each cookie parameter used to overwrite req.headers.Cookie, so only
the last one was sent. Append to the existing header instead.

Closes swagger-api#4155
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

OAS3 seems not to support multiple cookies

1 participant