8351983: HttpCookie Parser Incorrectly Handles Cookies with Expires Attribute #25636

Michael-Mc-Mahon · 2025-06-04T11:12:02Z

Hi,

This is a fix to j.n.HttpCookie (which has a doc/spec change). So, I'm targeting it to 26.
We currently do not obey the rule in RFC 6265 that says if both Max-Age and Expires attributes
are present in a cookie, the Max-Age should take precedence.

Thanks
Michael

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change requires CSR request JDK-8359343 to be approved
Change must not contain extraneous whitespace
Commit message must refer to an issue

Issues

JDK-8351983: HttpCookie Parser Incorrectly Handles Cookies with Expires Attribute (Bug - P4)
JDK-8359343: HttpCookie Parser Incorrectly Handles Cookies with Expires Attribute (CSR)

Reviewers

Daniel Fuchs (@dfuch - Reviewer)
Volkan Yazici (@vy - Committer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/25636/head:pull/25636
$ git checkout pull/25636

Update a local copy of the PR:
$ git checkout pull/25636
$ git pull https://git.openjdk.org/jdk.git pull/25636/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 25636

View PR using the GUI difftool:
$ git pr show -t 25636

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/25636.diff

Using Webrev

Link to Webrev Comment

bridgekeeper · 2025-06-04T13:08:31Z

👋 Welcome back michaelm! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2025-06-04T13:11:47Z

@Michael-Mc-Mahon This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8351983: HttpCookie Parser Incorrectly Handles Cookies with Expires Attribute

Reviewed-by: dfuchs, vyazici

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been no new commits pushed to the master branch. If another commit should be pushed before you perform the /integrate command, your PR will be automatically rebased. If you prefer to avoid any potential automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

openjdk · 2025-06-04T13:13:50Z

@Michael-Mc-Mahon The following label will be automatically applied to this pull request:

net

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

Michael-Mc-Mahon · 2025-06-04T13:25:07Z

/csr needed

openjdk · 2025-06-04T13:26:29Z

@Michael-Mc-Mahon has indicated that a compatibility and specification (CSR) request is needed for this pull request.

@Michael-Mc-Mahon please create a CSR request for issue JDK-8351983 with the correct fix version. This pull request cannot be integrated until the CSR request is approved.

mlbridge · 2025-06-04T13:31:10Z

Webrevs

dfuch

LGTM. A minor suggestion for the test.

dfuch · 2025-06-04T14:23:01Z

test/jdk/java/net/HttpCookie/MaxAgeExpires.java

+        // Date string in past.
+        new Test(-1, "Thu, 01 Jan 2024 00:00:00 GMT", 0, true),
+        new Test(1000, "Thu, 01 Jan 2024 00:00:00 GMT", 1000, false),
+        new Test(0, "Thu, 01 Jan 2024 00:00:00 GMT", 0, true),


Maybe you could add a test case with maxAge=1000 and expires = set at the current time + 500s. The expected maxAge would be 1000.

Something like:

static final String NOW_PLUS_500 = DateTimeFormatter.RFC_1123_DATE_TIME.format( java.time.ZonedDateTime.ofInstant(Instant.now().plusSeconds(500), ZoneId.of("UTC")));

...

new Test(1000, NOW_PLUS_500, 1000, false),

Ideally we'd like to test the same with maxAge = -1, but that could be tricky since we can't know in advance the exact value that will be computed for the new maxAge.

Alternatively, we could create a HttpCookie::parse method¹ accepting a long currentTimeMillis, and precisely determine the expected value?

¹ This can either be private and accessed via reflection, or package-private and accessed by placing the test in the same package.

I'll look into doing both of those. So long as we are immune to timing related issues it seems reasonable. By the way, I will push an implementation update first, which results from existing cookie regression failures.

vy · 2025-06-05T05:31:28Z

test/jdk/java/net/HttpCookie/MaxAgeExpires.java

+        // Date string in past.
+        new Test(-1, "Thu, 01 Jan 2024 00:00:00 GMT", 0, true),
+        new Test(1000, "Thu, 01 Jan 2024 00:00:00 GMT", 1000, false),
+        new Test(0, "Thu, 01 Jan 2024 00:00:00 GMT", 0, true),


Alternatively, we could create a HttpCookie::parse method¹ accepting a long currentTimeMillis, and precisely determine the expected value?

¹ This can either be private and accessed via reflection, or package-private and accessed by placing the test in the same package.

vy · 2025-06-05T05:32:34Z

test/jdk/java/net/HttpCookie/MaxAgeExpires.java

+        }
+    }
+
+    static Test[] tests = new Test[] {


Tip: JUnit @ParameterizedTest @CsvSource can save us some boilerplate here.

I've updated the implementation to allow for testing with fixed cookie creation times and expiry check times. And then added some tests of this. If we're okay with it, I'd like to work on the CSR at this point.

vy · 2025-06-05T05:32:56Z

test/jdk/java/net/HttpCookie/MaxAgeExpires.java

+/*
+ * @test
+ * @bug 8351983
+ * @summary HttpCookie Parser Incorrectly Handles Cookies with Expires Attribute


Aren't we missing a @run tag?

Aren't we missing a @run tag?

@run defaults to running the main method

vy · 2025-06-05T05:33:48Z

src/java.base/share/classes/java/net/HttpCookie.java

Copyright year needs to be updated.

dfuch · 2025-06-12T12:48:20Z

@Michael-Mc-Mahon
I still want to have a look at the (new) implementation changes but I agree with the principle, so it should not stop you starting the CSR process.

Michael-Mc-Mahon · 2025-06-12T12:58:17Z

@Michael-Mc-Mahon I still want to have a look at the (new) implementation changes but I agree with the principle, so it should not stop you starting the CSR process.

No rush. Thanks!

vy · 2025-06-12T18:20:58Z

src/java.base/share/classes/java/net/HttpCookie.java

+            if (name.equalsIgnoreCase("max-age") && maxAgeValue == null) {
+                maxAgeValue = value;
+                continue;
+            }
+            if (name.equalsIgnoreCase("expires") && expiresValue == null) {
+                expiresValue = value;
+                continue;
+            }

            // assign attribute to cookie
            assignAttribute(cookie, name, value);
        }
+        assignMaxAgeAttribute(cookie, expiresValue, maxAgeValue);


@Michael-Mc-Mahon, instead of making an exception for max-age and expires, and removing them from assignors, can't we convert the type of assignors from Map to List and add max-age & expires entries at the end?

@Michael-Mc-Mahon, instead of making an exception for max-age and expires, and removing them from assignors, can't we convert the type of assignors from Map to List and add max-age & expires entries at the end?

Just converting from Map to List wouldn't be enough. The problem is that both attribute types need to be handled together. You could change the attribute name recognition to some kind of pattern match to recognise either of them. Then you need to know which of them was set and what their values were.

Maybe, I could at least use the assignor pattern to recognise the two attributes and limit the special code to just actioning the values. I'll take a look at that now.

I think the last commit (b221131) just worsened things – now the logic is spread across assignMaxAgeAttribute, assignors, and instance variables, whereas earlier it was only in assignMaxAgeAttribute. 🫤 I suggest simply reverting it, that is, switching the state back to 9a495d7.

I agree that introducing a smarter data structure and iteration scheme to assignors would simplify things, though that is probably out of the scope of this work.

Apologies for the inconvenience and thanks so much for your patient cooperation. 🙇

I think the last commit (b221131) just worsened things – now the logic is spread across assignMaxAgeAttribute, assignors, and instance variables, whereas earlier it was only in assignMaxAgeAttribute. 🫤 I suggest simply reverting it, that is, switching the state back to 9a495d7.

I agree that introducing a smarter data structure and iteration scheme to assignors would simplify things, though that is probably out of the scope of this work.

Apologies for the inconvenience and thanks so much for your patient cooperation. 🙇

Yeah, I agree. I will revert it. The old version was clearer.

This reverts commit b221131.

dfuch

LGTM. should we be more specific about the partial support?

Michael-Mc-Mahon · 2025-06-24T09:15:26Z

/integrate

openjdk · 2025-06-24T09:16:03Z

Going to push as commit 116b854.

openjdk · 2025-06-24T09:16:15Z

@Michael-Mc-Mahon Pushed as commit 116b854.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

Michael-Mc-Mahon added 6 commits June 3, 2025 11:43

doc update only

42144ef

further doc update

76d41e7

doc update

9d4957c

Merge branch 'master' into cookie-8351983

faed1a4

impl and test + doc update

8619aa1

update

b0ab727

openjdk bot added the net [email protected] label Jun 4, 2025

openjdk bot added the csr Pull request needs approved CSR before integration label Jun 4, 2025

whitespace

cf25c05

openjdk bot added the rfr Pull request is ready for review label Jun 4, 2025

dfuch approved these changes Jun 4, 2025

View reviewed changes

vy reviewed Jun 5, 2025

View reviewed changes

Michael-Mc-Mahon added 5 commits June 5, 2025 14:42

impl update

2ab5478

copyright

53d5c25

Merge branch 'master' into cookie-8351983

ef97570

test and impl update

e44ccf9

test update

9a495d7

vy reviewed Jun 12, 2025

View reviewed changes

Michael-Mc-Mahon added 3 commits June 13, 2025 16:15

impl update

b221131

Revert "impl update"

75690ec

This reverts commit b221131.

Merge branch 'master' into cookie-8351983

9ee697d

dfuch approved these changes Jun 18, 2025

View reviewed changes

vy approved these changes Jun 18, 2025

View reviewed changes

doc update from CSR review

a6631ae

dfuch approved these changes Jun 19, 2025

View reviewed changes

Michael-Mc-Mahon added 2 commits June 19, 2025 14:55

apidoc update

8d34be8

Merge branch 'master' into cookie-8351983

3b71e4f

dfuch approved these changes Jun 19, 2025

View reviewed changes

vy approved these changes Jun 20, 2025

View reviewed changes

openjdk bot added ready Pull request is ready to be integrated and removed csr Pull request needs approved CSR before integration labels Jun 24, 2025

Merge branch 'master' into cookie-8351983

6eba52a

openjdk bot added the integrated Pull request has been integrated label Jun 24, 2025

openjdk bot closed this Jun 24, 2025

openjdk bot removed ready Pull request is ready to be integrated rfr Pull request is ready for review labels Jun 24, 2025

Michael-Mc-Mahon deleted the cookie-8351983 branch June 24, 2025 09:22

8351983: HttpCookie Parser Incorrectly Handles Cookies with Expires Attribute #25636

8351983: HttpCookie Parser Incorrectly Handles Cookies with Expires Attribute #25636

Uh oh!

Conversation

Michael-Mc-Mahon commented Jun 4, 2025 • edited by openjdk bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Progress

Issues

Reviewers

Reviewing

Uh oh!

bridgekeeper bot commented Jun 4, 2025

Uh oh!

openjdk bot commented Jun 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openjdk bot commented Jun 4, 2025

Uh oh!

Michael-Mc-Mahon commented Jun 4, 2025

Uh oh!

openjdk bot commented Jun 4, 2025

Uh oh!

mlbridge bot commented Jun 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Webrevs

Uh oh!

dfuch left a comment

Choose a reason for hiding this comment

Uh oh!

dfuch Jun 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vy Jun 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dfuch commented Jun 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Michael-Mc-Mahon commented Jun 12, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dfuch left a comment

Choose a reason for hiding this comment

Uh oh!

Michael-Mc-Mahon commented Jun 24, 2025

Uh oh!

openjdk bot commented Jun 24, 2025

Uh oh!

openjdk bot commented Jun 24, 2025

Uh oh!

Uh oh!

Michael-Mc-Mahon commented Jun 4, 2025 •

edited by openjdk bot

Loading

openjdk bot commented Jun 4, 2025 •

edited

Loading

mlbridge bot commented Jun 4, 2025 •

edited

Loading

dfuch Jun 4, 2025 •

edited

Loading

vy Jun 5, 2025 •

edited

Loading

dfuch commented Jun 12, 2025 •

edited

Loading