Bug #16052: net/http get_fields doesn't return correct value for set-cookie

• Status: Closed
• Assignee: -
• Target version: -
• ruby -v: 2.6.3
• Backport: 2.5: UNKNOWN, 2.6: UNKNOWN

[MarioRuiz (Mario Ruiz Sánchez)]

This is the code that reproduces the problem:

  require 'net/http'
  require 'net/https'
  path = "/authorize?client_id=kbyuFDidLLm280LIwVFiazOqjO3ty8KH&response_type=code"

  http = Net::HTTP.new('samples.auth0.com', 443)
  http.use_ssl = true
  http.start
  resp = http.get(path)
  p resp[:'set-cookie']
  p resp['set-cookie']
  resp[:'set-cookie'] = resp['set-cookie']
  p resp[:'set-cookie']
  p resp['set-cookie']
  p resp.get_fields('set-cookie')

On Ruby 2.5.1 this is the output:
nil
"did=s%3Av0%3Acf7f3a90-b91e-11e9-bf5d-25ae2d9eb2c4.IBWyPWhpTfJPWpjNMmTdWZ%2BjBrJMiGqfB%2B%2BlMkPiJ1o; Max-Age=157788000; Path=/; Expires=Tue, 06 Aug 2024 20:22:39 GMT; HttpOnly; Secure, auth0=s%3Az7GYMZaYa-uuoDoR_r0cKOvabZtiBOkS.CJdk9IkLJpTrOUXKfEGLgAnJm%2B%2BRUooYzZD5Bg5F5Ps; Path=/; Expires=Sat, 10 Aug 2019 14:22:39 GMT; HttpOnly; Secure"
"did=s%3Av0%3Acf7f3a90-b91e-11e9-bf5d-25ae2d9eb2c4.IBWyPWhpTfJPWpjNMmTdWZ%2BjBrJMiGqfB%2B%2BlMkPiJ1o; Max-Age=157788000; Path=/; Expires=Tue, 06 Aug 2024 20:22:39 GMT; HttpOnly; Secure, auth0=s%3Az7GYMZaYa-uuoDoR_r0cKOvabZtiBOkS.CJdk9IkLJpTrOUXKfEGLgAnJm%2B%2BRUooYzZD5Bg5F5Ps; Path=/; Expires=Sat, 10 Aug 2019 14:22:39 GMT; HttpOnly; Secure"
"did=s%3Av0%3Acf7f3a90-b91e-11e9-bf5d-25ae2d9eb2c4.IBWyPWhpTfJPWpjNMmTdWZ%2BjBrJMiGqfB%2B%2BlMkPiJ1o; Max-Age=157788000; Path=/; Expires=Tue, 06 Aug 2024 20:22:39 GMT; HttpOnly; Secure, auth0=s%3Az7GYMZaYa-uuoDoR_r0cKOvabZtiBOkS.CJdk9IkLJpTrOUXKfEGLgAnJm%2B%2BRUooYzZD5Bg5F5Ps; Path=/; Expires=Sat, 10 Aug 2019 14:22:39 GMT; HttpOnly; Secure"
["did=s%3Av0%3Acf7f3a90-b91e-11e9-bf5d-25ae2d9eb2c4.IBWyPWhpTfJPWpjNMmTdWZ%2BjBrJMiGqfB%2B%2BlMkPiJ1o; Max-Age=157788000; Path=/; Expires=Tue, 06 Aug 2024 20:22:39 GMT; HttpOnly; Secure", "auth0=s%3Az7GYMZaYa-uuoDoR_r0cKOvabZtiBOkS.CJdk9IkLJpTrOUXKfEGLgAnJm%2B%2BRUooYzZD5Bg5F5Ps; Path=/; Expires=Sat, 10 Aug 2019 14:22:39 GMT; HttpOnly; Secure"]

The first p resp[:'set-cookie'] returns nil and get_fields returns an array of two elements.

When running that code on Ruby 2.6.3
"did=s%3Av0%3A84199fa0-b91e-11e9-b07e-63edc59883b4.WbrSsi6W9fe1qJBMTC4xQhn3HewT121huAZ597Fz3Pg; Max-Age=157788000; Path=/; Expires=Tue, 06 Aug 2024 20:20:32 GMT; HttpOnly; Secure, auth0=s%3AEBmv1xWqukwMjYxrWssv735VQZFAMby3.r1eoqEebr4tGVTiOUNMvp%2BS0rx5D1mm9pgKYnE6CXMk; Path=/; Expires=Sat, 10 Aug 2019 14:20:32 GMT; HttpOnly; Secure"
"did=s%3Av0%3A84199fa0-b91e-11e9-b07e-63edc59883b4.WbrSsi6W9fe1qJBMTC4xQhn3HewT121huAZ597Fz3Pg; Max-Age=157788000; Path=/; Expires=Tue, 06 Aug 2024 20:20:32 GMT; HttpOnly; Secure, auth0=s%3AEBmv1xWqukwMjYxrWssv735VQZFAMby3.r1eoqEebr4tGVTiOUNMvp%2BS0rx5D1mm9pgKYnE6CXMk; Path=/; Expires=Sat, 10 Aug 2019 14:20:32 GMT; HttpOnly; Secure"
"did=s%3Av0%3A84199fa0-b91e-11e9-b07e-63edc59883b4.WbrSsi6W9fe1qJBMTC4xQhn3HewT121huAZ597Fz3Pg; Max-Age=157788000; Path=/; Expires=Tue, 06 Aug 2024 20:20:32 GMT; HttpOnly; Secure, auth0=s%3AEBmv1xWqukwMjYxrWssv735VQZFAMby3.r1eoqEebr4tGVTiOUNMvp%2BS0rx5D1mm9pgKYnE6CXMk; Path=/; Expires=Sat, 10 Aug 2019 14:20:32 GMT; HttpOnly; Secure"
"did=s%3Av0%3A84199fa0-b91e-11e9-b07e-63edc59883b4.WbrSsi6W9fe1qJBMTC4xQhn3HewT121huAZ597Fz3Pg; Max-Age=157788000; Path=/; Expires=Tue, 06 Aug 2024 20:20:32 GMT; HttpOnly; Secure, auth0=s%3AEBmv1xWqukwMjYxrWssv735VQZFAMby3.r1eoqEebr4tGVTiOUNMvp%2BS0rx5D1mm9pgKYnE6CXMk; Path=/; Expires=Sat, 10 Aug 2019 14:20:32 GMT; HttpOnly; Secure"
["did=s%3Av0%3A84199fa0-b91e-11e9-b07e-63edc59883b4.WbrSsi6W9fe1qJBMTC4xQhn3HewT121huAZ597Fz3Pg; Max-Age=157788000; Path=/; Expires=Tue, 06 Aug 2024 20:20:32 GMT; HttpOnly; Secure, auth0=s%3AEBmv1xWqukwMjYxrWssv735VQZFAMby3.r1eoqEebr4tGVTiOUNMvp%2BS0rx5D1mm9pgKYnE6CXMk; Path=/; Expires=Sat, 10 Aug 2019 14:20:32 GMT; HttpOnly; Secure"]

The first p resp[:'set-cookie'] returns a value and get_fields returns an array of 1 element.

[alanwu (Alan Wu)]

I think this was changed in #15394. Since the symbol and the string both refer to the same header, I think it's reasonable to treat them the same.

[jeremyevans0 (Jeremy Evans)]

• Status changed from Open to Closed