fix(cookies): support valueless unparsed attributes in stringify - #5720
Open
koding88 wants to merge 2 commits into
Open
fix(cookies): support valueless unparsed attributes in stringify#5720koding88 wants to merge 2 commits into
koding88 wants to merge 2 commits into
Conversation
Previously, stringify() required all items in cookie.unparsed to contain an '=' character and threw an 'Invalid unparsed' error for valueless attributes. RFC 6265bis allows extension attributes without a value (such as 'Partitioned' for CHIPS or other custom flags). This allows valueless attributes in unparsed while continuing to validate their names against the cookie-name grammar.
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request updates Undici’s cookie header serialization to allow boolean/valueless extension attributes in cookie.unparsed (e.g. Partitioned) to be emitted by stringify() instead of throwing.
Changes:
- Update
lib/web/cookies/util.jsstringify()to accept unparsed parts without=by validating and appending the trimmed attribute name as-is. - Add a regression test ensuring
setCookie()can producePartitionedin theSet-Cookieheader when provided viaunparsed.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| lib/web/cookies/util.js | Allows valueless entries in cookie.unparsed to be serialized as bare attributes (no =). |
| test/cookie/cookies.js | Adds coverage for setCookie() + valueless unparsed attribute (Partitioned). |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
326
to
+330
| for (const part of cookie.unparsed) { | ||
| if (!part.includes('=')) { | ||
| throw new Error('Invalid unparsed') | ||
| } | ||
|
|
||
| const [key, ...value] = part.split('=') | ||
| if (part.includes('=')) { | ||
| const [key, ...value] = part.split('=') | ||
|
|
||
| const trimmedKey = key.trim() | ||
| const joinedValue = value.join('=') | ||
| const trimmedKey = key.trim() |
Author
There was a problem hiding this comment.
Added check for empty trimmed attribute names and added negative test cases in cf530aa.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Allows
setCookie()/stringify()to handle valueless (boolean) extension attributes incookie.unparsed, such asPartitioned(CHIPS / RFC 6265bis) or other name-only extension flags, without throwingInvalid unparsed.Motivation & Background
RFC 6265bis section 5.4 defines
extension-avas containing eithername=valueor name-only attributes (e.g.Partitioned). Previously,stringify()inlib/web/cookies/util.jsstrictly required every entry incookie.unparsedto include an=character, throwingnew Error('Invalid unparsed')when passing valueless attributes.Changes
stringify()inlib/web/cookies/util.jsto branch onpart.includes('='):=, validate name & value and format asname=value.=, validate name against cookie-name grammar and format asname.test/cookie/cookies.js.Verification
node --test test/cookie/*.js: 92/92 tests pass.npm run test:unit: 1,517/1,517 tests pass (0 failures).npm run lint: Clean (0 warnings, 0 errors).