[nginx-quic] fastcgi cookie param is overwritten resulting in getting only last cookie

[Sergey Kandaurov]

> On 23 Dec 2021, at 19:19, Guillaume Bilic <guillaume.bilic at gmail.com> wrote:
> 
> Hi all,
> 
>  
> 
> Using nginx-quic (1.21.4), cookies are parsed individually by http3 code :
> 
>  
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 parse literal done "number1=this+is+the+first+one"
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 parse field lri done static[5] "number1=this+is+the+first+one"
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 static[5] lookup "cookie":""
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 parse field representation done
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 header: "cookie: number1=this+is+the+first+one"
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 parse field representation
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 parse field lri
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 parse prefix int 5
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 parse prefix int 24
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 parse literal huff:1, len:24
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 parse literal done "number2=this+is+the+second+one"
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 parse field lri done static[5] "number2=this+is+the+second+one"
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 static[5] lookup "cookie":""
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 parse field representation done
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 header: "cookie: number2=this+is+the+second+one"
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 parse field representation
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 parse field lri
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 parse prefix int 5
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 parse prefix int 23
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 parse literal huff:1, len:23
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 parse literal done "number3=this+is+the+third+one"
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 parse field lri done static[5] "number3=this+is+the+third+one"
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 static[5] lookup "cookie":""
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 parse field representation done
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 parse headers done
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 http3 header: "cookie: number3=this+is+the+third+one »
> 
>  
> 
>  
> 
> But then the fastcgi param HTTP_COOKIE is passed for each cookie, resulting in overwriting it and keeping only the last one :
> 
>  
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 fastcgi param: "HTTP_COOKIE: number1=this+is+the+first+one"
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 fastcgi param: "HTTP_COOKIE: number2=this+is+the+second+one"
> 
> 2021/12/23 14:29:37 [debug] 32322#0: *3576 fastcgi param: "HTTP_COOKIE: number3=this+is+the+third+one »
> 
>  
> 
> The HTTP_COOKIE param should be the whole cookie header.
> 
> Http2 code handles cookie header in a dedicated function « ngx_http_v2_construct_cookie_header » and then processes other headers.
> 
> There doesn’t seem to be the case of http3 code which process cookie the same way of others headers. 

This behaviour was recently applied to HTTP/3 implementation,
see https://hg.nginx.org/nginx-quic/rev/10522e8dea41
Thanks for prodding.

-- 
Sergey Kandaurov