Multiple Set-Cookie responses in HTTP GET headers

bbaarrnneess · January 21, 2014, 8:32pm

Hi all, I am making a network request (http get) to a web site to store the cookie value. My problem is that the get request lists three set-cookie responses in the header. In corona it is only displaying the third (last) set-cookie response in the header. Is there anyway I can see the first two so I can piece togther the full cookie? Has anyone else ran into this before (I have searched long and far without finding anything)? I’d greatly appreciate it… thanks!

anshuman · February 5, 2014, 10:43am

Did you have any luck with this? I have similar issues with the network request behaviour and restrictions, couple of them are listed here :

http://forums.coronalabs.com/topic/40698-cookie-changes-during-network-request-302-moved/

http://forums.coronalabs.com/topic/43864-network-request-works-in-simulator-and-nexus-but-not-on-samsung-or-htc/

I am not getting any replies though :(

rob · February 6, 2014, 12:38am

Just to make sure, the web server is setting three cookies, but you are only seeing one in the headers?

Can you post what you are getting here?

Thanks

Rob

anshuman · February 8, 2014, 10:00am

Hi Rob,

Thanks for responding, please consider this simple case below:

local function networkListener( event ) print "Entering: networkListener" print "=========================" for key,value in pairs(event.responseHeaders) do print(key,": ",value) end end network.request( "http://www.google.com", "GET", networkListener )

The code output is:

Entering: networkListener ========================= Content-Type : text/html; charset=ISO-8859-1 X-XSS-Protection : 1; mode=block Date : Sat, 08 Feb 2014 09:53:17 GMT X-Frame-Options : SAMEORIGIN Transfer-Encoding : Identity Cache-Control : private, max-age=0 Alternate-Protocol : 80:quic Expires : -1 Server : gws

However, if we do the exact thing using Firefox/Firebug, we can see that the response headers had multiple cookies:

Response Headers Alternate-Protocol 80:quic Cache-Control private Content-Length 261 Content-Type text/html; charset=UTF-8 Date Sat, 08 Feb 2014 09:48:30 GMT Location http://www.google.co.uk/?gws\_rd=cr&ei=bv31UsinIYnOygPtxIDoBg P3P CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info." Server gws Set-Cookie PREF=ID=df754f3e24a6dea4:FF=0:TM=1391852910:LM=1391852910:S=pXRYqDyguoDSht7z; expires=Mon, 08-Feb-2016 09:48:30 GMT; path=/; domain=.google.com NID=67=RPcGyy7je\_3fIRcV6ESMerQjm\_zx0SBPp7VXlkZFQOzbxZyszLc\_slYeZVp0tOjxM6G5rWkutnaIqaQsPXOadZlZy-O-hXCcABGHQ2lozj7gXL\_nWUh7WJBnj7Gbe3f7; expires=Sun, 10-Aug-2014 09:48:30 GMT; path=/; domain=.google.com; HttpOnly X-XSS-Protection 1; mode=block x-frame-options SAMEORIGIN

So the key question is: Why is event.responseHeaders not showing any [“Set-Cookie”] params?

Thanks and regards,

Anshuman

anshuman · February 13, 2014, 8:23am

I believe this is related to http://forums.coronalabs.com/topic/40698-cookie-changes-during-network-request-302-moved/ as well, in both cases there is a HTTP 302 involved and we are unable to get all the cookies that were sent by the server response(s) in the lua code.

rob · February 13, 2014, 1:11pm

Engineering is narrowing in on it and it does seem to be related to the redirects.

On a side note, based on the headers above, there won’t be multiple cookie headers, just one entry for “Set-Cookie” and you will have to parse out the multiple cookies that are attached to the one entry.

Rob

anshuman · February 13, 2014, 1:16pm

Thanks for the update Rob.

I agree with you that they will still be in the same entry, am more than happy to parse it.

Regards,

Anshuman

anshuman · February 21, 2014, 7:23pm

There is now a handleRedirects option in the network.request() parameters which are documented here:

http://docs.coronalabs.com/daily/api/library/network/request.html#params-optional

params.handleRedirects A boolean indicating whether automatic redirect handling (the default) is desired. Set this to false if you want to receive 302 responses and handle them yourself. This may be needed for certain kinds of login schemes or custom cookie handling.

local function networkListenerLogin( event ) print “== Entering: networkListenerLogin ==” – for key,value in pairs(event.responseHeaders) do print(key,": ",value) end – print(event.response) if (event.responseHeaders[‘Set-Cookie’]) then myCookie = event.responseHeaders[‘Set-Cookie’] – save cookie, keep appending later end if (event.responseHeaders[‘Location’]) then local headers = {} if myCookie then headers[“Cookie”] = myCookie – set cookie in header end local params = {} params.headers = headers params.handleRedirects = false network.request( event.responseHeaders[‘Location’], “GET”, networkListenerLogin, params ) end end local headers = {} local body = “POST body with username and password” local params = {} params.headers = headers params.body = body params.handleRedirects = false network.request( “targetURL”, “POST”, networkListenerLogin, params)

This way we can capture all cookies and manually set cookie in HTTP header.

Cheers,

Anshuman

anshuman · February 5, 2014, 10:43am

Did you have any luck with this? I have similar issues with the network request behaviour and restrictions, couple of them are listed here :

http://forums.coronalabs.com/topic/40698-cookie-changes-during-network-request-302-moved/

http://forums.coronalabs.com/topic/43864-network-request-works-in-simulator-and-nexus-but-not-on-samsung-or-htc/

I am not getting any replies though :(

rob · February 6, 2014, 12:38am

Just to make sure, the web server is setting three cookies, but you are only seeing one in the headers?

Can you post what you are getting here?

Thanks

Rob

anshuman · February 8, 2014, 10:00am

Hi Rob,

Thanks for responding, please consider this simple case below:

local function networkListener( event ) print "Entering: networkListener" print "=========================" for key,value in pairs(event.responseHeaders) do print(key,": ",value) end end network.request( "http://www.google.com", "GET", networkListener )

The code output is:

Entering: networkListener ========================= Content-Type : text/html; charset=ISO-8859-1 X-XSS-Protection : 1; mode=block Date : Sat, 08 Feb 2014 09:53:17 GMT X-Frame-Options : SAMEORIGIN Transfer-Encoding : Identity Cache-Control : private, max-age=0 Alternate-Protocol : 80:quic Expires : -1 Server : gws

However, if we do the exact thing using Firefox/Firebug, we can see that the response headers had multiple cookies:

Response Headers Alternate-Protocol 80:quic Cache-Control private Content-Length 261 Content-Type text/html; charset=UTF-8 Date Sat, 08 Feb 2014 09:48:30 GMT Location http://www.google.co.uk/?gws\_rd=cr&ei=bv31UsinIYnOygPtxIDoBg P3P CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info." Server gws Set-Cookie PREF=ID=df754f3e24a6dea4:FF=0:TM=1391852910:LM=1391852910:S=pXRYqDyguoDSht7z; expires=Mon, 08-Feb-2016 09:48:30 GMT; path=/; domain=.google.com NID=67=RPcGyy7je\_3fIRcV6ESMerQjm\_zx0SBPp7VXlkZFQOzbxZyszLc\_slYeZVp0tOjxM6G5rWkutnaIqaQsPXOadZlZy-O-hXCcABGHQ2lozj7gXL\_nWUh7WJBnj7Gbe3f7; expires=Sun, 10-Aug-2014 09:48:30 GMT; path=/; domain=.google.com; HttpOnly X-XSS-Protection 1; mode=block x-frame-options SAMEORIGIN

So the key question is: Why is event.responseHeaders not showing any [“Set-Cookie”] params?

Thanks and regards,

Anshuman

anshuman · February 13, 2014, 8:23am

I believe this is related to http://forums.coronalabs.com/topic/40698-cookie-changes-during-network-request-302-moved/ as well, in both cases there is a HTTP 302 involved and we are unable to get all the cookies that were sent by the server response(s) in the lua code.

rob · February 13, 2014, 1:11pm

Engineering is narrowing in on it and it does seem to be related to the redirects.

On a side note, based on the headers above, there won’t be multiple cookie headers, just one entry for “Set-Cookie” and you will have to parse out the multiple cookies that are attached to the one entry.

Rob

anshuman · February 13, 2014, 1:16pm

Thanks for the update Rob.

I agree with you that they will still be in the same entry, am more than happy to parse it.

Regards,

Anshuman

anshuman · February 21, 2014, 7:23pm

There is now a handleRedirects option in the network.request() parameters which are documented here:

http://docs.coronalabs.com/daily/api/library/network/request.html#params-optional

params.handleRedirects A boolean indicating whether automatic redirect handling (the default) is desired. Set this to false if you want to receive 302 responses and handle them yourself. This may be needed for certain kinds of login schemes or custom cookie handling.

local function networkListenerLogin( event ) print “== Entering: networkListenerLogin ==” – for key,value in pairs(event.responseHeaders) do print(key,": ",value) end – print(event.response) if (event.responseHeaders[‘Set-Cookie’]) then myCookie = event.responseHeaders[‘Set-Cookie’] – save cookie, keep appending later end if (event.responseHeaders[‘Location’]) then local headers = {} if myCookie then headers[“Cookie”] = myCookie – set cookie in header end local params = {} params.headers = headers params.handleRedirects = false network.request( event.responseHeaders[‘Location’], “GET”, networkListenerLogin, params ) end end local headers = {} local body = “POST body with username and password” local params = {} params.headers = headers params.body = body params.handleRedirects = false network.request( “targetURL”, “POST”, networkListenerLogin, params)

This way we can capture all cookies and manually set cookie in HTTP header.

Cheers,

Anshuman