You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When you add multiple Set-Cookie headers to the response, actually they are combined and only one header is sent with comma-separated cookies. According to RFC2109 it is a valid syntax. But it is not according to RFC6265, which deprecates RFC2109
Proposal:
// Http cookie type. Note that only name and value are used for Http requests
message RpcHttpCookie {
// Enum that lets servers require that a cookie shouoldn't be sent with cross-site requests
enum SameSite {
Undefined = 0;
Strict = 1;
Lax = 2;
}
// Cookie name
name: string,
// Cookie value
value: string,
// Specifies allowed hosts to receive the cookie
domain: NullableString,
// Specifies URL path that must exist in the requested URL
path: NullableString,
// Sets the cookie to expire at a specific date instead of when the client closes
expires: NullableString // becomes Nullable<DateTimeOffset> in C#, maybe use google.protobuf.Timestamp?
// Sets the cookie to only be sent with an encrypted request
secure: bool,
// Sets the cookie to be inaccessible to JavaScript's Document.cookie API
http_only: bool,
// Can restrict the cookie to not be sent with cross-site requests
same_site: SameSite,
// Sets the cookie to expire after a specific length of time instead of when the client closes
max_age: NullableString // becomes Nullable<TimeSpan> in C#, maybe use google.protobuf.Duration?
}
The text was updated successfully, but these errors were encountered:
We need to allow users to set multiple cookies on the HttpResponse, since we can't fold multiple cookie values into one header and the HttpRequest object does not support duplicated headers.
Proposal:
The text was updated successfully, but these errors were encountered: