Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[BUG] Cookies matcher doesn't work properly (cookies wrongly parsed it seems) #888

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
lauri865 opened this issue May 28, 2025 · 5 comments · Fixed by #889
Closed

[BUG] Cookies matcher doesn't work properly (cookies wrongly parsed it seems) #888

lauri865 opened this issue May 28, 2025 · 5 comments · Fixed by #889
Labels
bug Something isn't working

Comments

@lauri865
Copy link

Describe the bug

We have a missing cookie rewrite which doesn't work. After some debugging, it seems like the issue is in cookies being wrongly parsed.

Cookies passed to the matcher:
cookies { _ga: 'xxx; codeVariant' }

Cookies from the headers:
cookie: 'xxx; codeVariant=TS; codeStyling=none; _ga_XJ83JQEK7J=xxx; crisp-client%2Fsession%2Fd4cd5bac-6848-4f4d-9a7f-082f5b324b79=xxx; _octo=xxx; sidebar:state=false; cpu_bucket=xxx; preferred_color_mode=xxx; tz=xxx; test=xxx'

This implementation is wrong:

opennextjs-aws/packages/open-next/src/http/util.ts

Line 39 in ab492ca

? cookies.split(/(?<!Expires=\w+),/i).map((c) => c.trim())

Cookies are semicolon-separated, not comma-separated.

Steps to reproduce

  1. Add a rewrite to next.config:
    async rewrites() { return { beforeFiles: [ { source: "/test", destination: "https://github.com", missing: [ { type: "cookie", key: "test", }, ], }, ], }; },

  2. Add a cookie test with any value.

  3. The rewrite will always pass.

Expected behavior

Rewrite should

@opennextjs/cloudflare version

1.0.4

Wrangler version

4.17.0

next info output

N/A

Additional context

No response
@lauri865 lauri865 added the bug Something isn't working label May 28, 2025
@vicb
Copy link
Contributor

vicb commented Jun 2, 2025

Moving the issue to the aws repo where the issue should be fixed.

I think we have multiple issues here: parseCookies parses Response cookies, i.e. the Set-Cookie header. We should probably renamed that function.

Request cookies are in the form key=value; ....

So I believe we should not use parseCookies in:

  • packages/open-next/src/overrides/converters/node.ts
  • convertFrom in packages/open-next/src/overrides/converters/edge.ts

We should double check all the usage of parseCookies

@vicb vicb transferred this issue from opennextjs/opennextjs-cloudflare Jun 2, 2025
@khuezy
Copy link
Contributor

khuezy commented Jun 2, 2025 •
edited
Loading

IIRC, the problem was that the cookie property includes multiple cookies, which are delimited by a comma. The individual cookie values are indeed separated by semicolons. So it needs to both handle , and ;... hence the regex.

The Expires field takes in a Date string that includes a comma, eg: Expires=June 1, 2025.

As Victor said, I think the function is correct, it's probably being used in the wrong place.

@sommeeeer
Copy link
Contributor

Should we consider using the package cookie for parsing the cookie header on incoming request headers? Next uses it and it has been battle tested for years.

The request coming in here is wrong. The cookie header is just a string:

opennextjs-aws/packages/tests-unit/tests/converters/node.test.ts

Lines 181 to 195 in ab492ca

it("should convert PUT request with multiple cookie headers", async () => {
const result = await converter.convertFrom(
new IncomingMessage({
url: "/path",
method: "PUT",
headers: {
"content-length": "2",
"content-type": "application/json",
cookie: ["foo=bar", "hello=world"],
},
remoteAddress: "::1",
body: Buffer.from("{}"),
}),
);

@vicb
Copy link
Contributor

vicb commented Jun 2, 2025

@sommeeeer I have a PR coming (using the pkg), I'll update node.test.ts as you pointed in the message.
Thanks!

@sommeeeer
Copy link
Contributor

Great @vicb

@vicb vicb mentioned this issue Jun 2, 2025
Merged
@vicb vicb closed this as completed in #889 Jun 3, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix: cookie decoding for Node and Cloudflare opennextjs/opennextjs-aws
4 participants
@vicb @khuezy @lauri865 @sommeeeer