Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add "cookies" property to HttpRpc #31

Closed
mhoeger opened this issue Mar 26, 2019 · 1 comment · Fixed by #32
Closed

Add "cookies" property to HttpRpc #31

mhoeger opened this issue Mar 26, 2019 · 1 comment · Fixed by #32

Comments

@mhoeger
Copy link
Contributor

mhoeger commented Mar 26, 2019

We need to allow users to set multiple cookies on the HttpResponse, since we can't fold multiple cookie values into one header and the HttpRequest object does not support duplicated headers.

When you add multiple Set-Cookie headers to the response, actually they are combined and only one header is sent with comma-separated cookies. According to RFC2109 it is a valid syntax. But it is not according to RFC6265, which deprecates RFC2109

Proposal:

// Http cookie type. Note that only name and value are used for Http requests
message RpcHttpCookie {
    // Enum that lets servers require that a cookie shouoldn't be sent with cross-site requests
    enum SameSite {
        Undefined = 0;
        Strict = 1;
        Lax = 2;
    }
    
    // Cookie name
    name: string,
    
    // Cookie value
    value: string,

    // Specifies allowed hosts to receive the cookie
    domain: NullableString,

    // Specifies URL path that must exist in the requested URL
    path: NullableString,

    // Sets the cookie to expire at a specific date instead of when the client closes
    expires: NullableString // becomes Nullable<DateTimeOffset> in C#, maybe use google.protobuf.Timestamp?

    // Sets the cookie to only be sent with an encrypted request
    secure: bool, 

    // Sets the cookie to be inaccessible to JavaScript's Document.cookie API
    http_only: bool,

    // Can restrict the cookie to not be sent with cross-site requests
    same_site: SameSite,

    // Sets the cookie to expire after a specific length of time instead of when the client closes
    max_age: NullableString // becomes Nullable<TimeSpan> in C#, maybe use google.protobuf.Duration?
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant