[HttpFoundation] Create cookie from string + synchronize response cookies #20569

ro0NL · 2016-11-19T14:23:42Z

Q	A
Branch?	"master"
Bug fix?	yes
New feature?	yes
BC breaks?	no-ish
Deprecations?	no
Tests pass?	yes
Fixed tickets	comma-separated list of tickets fixed by the PR, if any
License	MIT
Doc PR	reference to the documentation PR, if any

Fixes the conversion/synchroniczation of cookies between the object API and string API, ie;

$headers->setCookie(new Cookie('foo', 'bar'));
$headers->has('set-cookie'); // true

$headers->set('set-cookie', 'foo2=bar2', false);
count($headers->getCookies()); // 2

With an additional feature Cookie::fromString($cookie)

The BC break happens in terms you cannot set a custom Set-Cookie header anymore, all cookies are set via set(raw)cookie by PHP.

We could go one step further by tracking misc. attributes (Cookie::getAttributes()) and populate accordingly from Cookie::fromString. If the cookie has attributes we should bypass setcookie and write a header instead, but im not sure it's worth it.

HeahDude · 2016-11-19T14:33:34Z

src/Symfony/Component/HttpFoundation/Cookie.php

@@ -32,6 +32,56 @@ class Cookie
    const SAMESITE_STRICT = 'strict';

    /**
+     * Create cookie from raw header string.


HeahDude · 2016-11-19T14:37:55Z

It seems there is no deprecation in your PR, wrong description or WIP?

ro0NL · 2016-11-19T14:48:37Z

Not sure :) i tend to think it solves more then it would break. Right now all cookies are dealt with in a consistent manner, which is good.

However we could lose some raw cookie attributes though, and people benefit from this bug before in terms of preserving those attributes. I think Cookie should fix this in terms of getting the same output string for the given input string. Which means no BC break :)

@HeahDude

wrong description

yes :) deprecation label should be removed

ro0NL · 2016-11-19T15:08:01Z

The synchronization is also missing in all, has, etc. Should this go all the way?

Or what about the other way around? Add a Set-Cookie header from setCookie().

ro0NL · 2016-11-19T16:57:40Z

Ready :)

HeahDude · 2016-11-19T20:00:58Z

src/Symfony/Component/HttpFoundation/Tests/ResponseHeaderBagTest.php

+
+        $headers = str_replace("\r\n", PHP_EOL, (string) $bag);
+        $this->assertRegExp('#^Set-Cookie:\s+foo=bar; path=/path/foo; domain=foo.bar; httponly$#m', $headers);
+        $this->assertRegExp('#^Set-Cookie:\s+foo=bar; path=/path/foo; domain=foo.bar; httponly$#m', $headers);


Shouldn't it be path=/path/bar;?

Nice catch, also regex escaping was missing. Fixed.

ro0NL · 2016-11-20T10:34:19Z

Green :)

fabpot · 2016-12-13T09:33:27Z

src/Symfony/Component/HttpFoundation/Cookie.php

-        if ($this->path) {
-            $str .= '; path='.$this->path;
-        }
+        $str .= '; path='.$this->getPath() ?: '/';


Why? IIRC, path is optional.

Based on https://github.com/ro0NL/symfony/blob/721fc351b2dcf81ba1888682a42155288f5474d2/src/Symfony/Component/HttpFoundation/Cookie.php#L124 i chose to force / by default here as well. Maybe it's not needed indeed.

I guess the only case we dont have a path is when a developer overrides Cookie::$path (set it manually).

What about

if ($this->getPath()) { //.. }

to be consistent with the domain attribute handling.

fabpot · 2016-12-13T09:34:35Z

src/Symfony/Component/HttpFoundation/HeaderBag.php

@@ -40,14 +40,14 @@ public function __construct(array $headers = array())
     */
    public function __toString()
    {
-        if (!$this->headers) {
+        if (!$headers = $this->all()) {


If you remove headers usage, the property should be removed as well... but it is protected, so that's a BC break.

ResponsHeaderBag overrides all() by including the additional cookie headers. HeaderBag::all still returns $this->headers... so it's not removed.

However internally it now uses all() (the API method) instead of $headers (the property) so those cookie headers are taken into account when using for example HeaderBag::has.

the property is still used.

In the normal HeaderBag, ->all() is a simple getter for it. But it is now overwritten in ResponseHeaderBag to add the set-cookie header

stof · 2016-12-13T10:14:58Z

src/Symfony/Component/HttpFoundation/Cookie.php


        if ('' === (string) $this->getValue()) {
            $str .= 'deleted; expires='.gmdate('D, d-M-Y H:i:s T', time() - 31536001);
        } else {
-            $str .= urlencode($this->getValue());
+            $str .= $this->isRaw() ? $this->getValue() : urlencode($this->getValue());


isn't this a bug fix ? If yes, it should go in older branches

Guess so. I will separate it this evening 👍

stof · 2016-12-13T10:17:19Z

src/Symfony/Component/HttpFoundation/HeaderBag.php

@@ -40,14 +40,14 @@ public function __construct(array $headers = array())
     */
    public function __toString()
    {
-        if (!$this->headers) {
+        if (!$headers = $this->all()) {


the property is still used.

In the normal HeaderBag, ->all() is a simple getter for it. But it is now overwritten in ResponseHeaderBag to add the set-cookie header

stof · 2016-12-13T10:20:12Z

src/Symfony/Component/HttpFoundation/ResponseHeaderBag.php

    {
-        return array_combine($this->headerNames, $this->headers);
+        $headers = $this->allPreserveCase();
+        if (isset($this->headerNames['set-cookie'])) {


what if a case is not provided for the set-cookie header ? you will not remove it at all

It's always provided.. ie. here and here

…ookies (ro0NL) This PR was squashed before being merged into the 3.1 branch (closes #20910). Discussion ---------- [HttpFoundation] Fix cookie to string conversion for raw cookies | Q | A | ------------- | --- | Branch? | 3.1 | Bug fix? | yes | New feature? | not really | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #20569 (comment) | License | MIT | Doc PR | symfony/symfony-docs#...  Separated from #20569 This mimics PHP's `setrawcookie` behavior. Commits ------- 5e899cd [HttpFoundation] Fix cookie to string conversion for raw cookies

This PR was merged into the 3.3-dev branch. Discussion ---------- [HttpFoundation] Compute cookie max-age attribute | Q | A | ------------- | --- | Branch? | master | Bug fix? | no | New feature? | yes | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | comma-separated list of tickets fixed by the PR, if any | License | MIT | Doc PR | reference to the documentation PR, if any See https://wiki.php.net/rfc/cookie_max-age, PHP sends it since 5.5. ~~The date format actually differs now from PHP (`Saturday` instead of `Sat`). But it really doesnt matter much imo, using the constant seems more reliable to me and max-age overrules anyway ;)~~ Relates to #20569 Commits ------- 8c28317 [HttpFoundation] Compute cookie max-age attribute

ro0NL · 2016-12-17T14:48:11Z

Rebased with the latest cookie changes. Still all good :)

…kies

fabpot · 2016-12-17T17:00:07Z

Thank you @ro0NL.

…ze response cookies (ro0NL) This PR was merged into the 3.3-dev branch. Discussion ---------- [HttpFoundation] Create cookie from string + synchronize response cookies | Q | A | ------------- | --- | Branch? | "master" | Bug fix? | yes | New feature? | yes | BC breaks? | no-ish | Deprecations? | no | Tests pass? | yes | Fixed tickets | comma-separated list of tickets fixed by the PR, if any | License | MIT | Doc PR | reference to the documentation PR, if any Fixes the conversion/synchroniczation of cookies between the object API and string API, ie; ```php $headers->setCookie(new Cookie('foo', 'bar')); $headers->has('set-cookie'); // true $headers->set('set-cookie', 'foo2=bar2', false); count($headers->getCookies()); // 2 ``` With an additional feature `Cookie::fromString($cookie)` The BC break happens in terms you cannot set a custom `Set-Cookie` header anymore, all cookies are set via `set(raw)cookie` by PHP. We could go one step further by tracking misc. attributes (`Cookie::getAttributes()`) and populate accordingly from `Cookie::fromString`. If the cookie has attributes we should bypass `setcookie` and write a header instead, but im not sure it's worth it. Commits ------- 7314456 [HttpFoundation] Create cookie from string + synchronize response cookies

This PR was merged into the 3.3-dev branch. Discussion ---------- [HttpFoundation] update changelog | Q | A | ------------- | --- | Branch? | master | Bug fix? | no | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #20569 | License | MIT | Doc PR | Commits ------- e91a654 [HttpFoundation] update changelog

This PR was merged into the 3.3-dev branch. Discussion ---------- [HttpKernel] Continuation of #20569 | Q | A | ------------- | --- | Branch? | master | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #20567 (comment) | License | MIT | Doc PR | symfony/symfony-docs#...  Forgotten in #20569 and makes #20567 truly a feature only. Before ![image](https://cloud.githubusercontent.com/assets/1047696/21361738/971e4f8e-c6e5-11e6-8b08-8a5f8ab4f1f0.png) After ![image](https://cloud.githubusercontent.com/assets/1047696/21361752/a6dc5380-c6e5-11e6-9f18-3bc3d7db94be.png) Commits ------- e1616b3 [HttpKernel] Continuation of #20569

This PR was squashed before being merged into the 2.7 branch (closes #20972). Discussion ---------- [HttpFoundation] Improved set cookie header tests | Q | A | ------------- | --- | Branch? | 2.7 (already in master) | Bug fix? | no | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #...  | License | MIT | Doc PR | symfony/symfony-docs#...  Separated from #20569 Commits ------- 05bce71 [HttpFoundation] Improved set cookie header tests

This PR was merged into the 3.3-dev branch. Discussion ---------- [WebProfilerBundle] Improved cookie traffic | Q | A | ------------- | --- | Branch? | "master" | Bug fix? | no | New feature? | yes | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | comma-separated list of tickets fixed by the PR, if any | License | MIT | Doc PR | reference to the documentation PR, if any ![image](https://cloud.githubusercontent.com/assets/1047696/20455635/a033a814-ae60-11e6-8500-e60146f4619e.png) Relates to #20569 in terms of getting _all_ the cookies. Commits ------- 171c6d1 [WebProfilerBundle] Improved cookie traffic

carsonbot added Status: Needs Review HttpFoundation Bug Feature Deprecation labels Nov 19, 2016

HeahDude reviewed Nov 19, 2016

View reviewed changes

chinhpl1904 approved these changes Nov 19, 2016

View reviewed changes

ro0NL mentioned this pull request Nov 19, 2016

[WebProfilerBundle] Improved cookie traffic #20567

Merged

HeahDude reviewed Nov 19, 2016

View reviewed changes

ro0NL mentioned this pull request Nov 26, 2016

[HttpFoundation] Compute cookie max-age attribute #20644

Merged

nicolas-grekas added this to the 3.x milestone Dec 6, 2016

fabpot reviewed Dec 13, 2016

View reviewed changes

stof reviewed Dec 13, 2016

View reviewed changes

ro0NL mentioned this pull request Dec 13, 2016

[HttpFoundation] Fix cookie to string conversion for raw cookies #20910

Closed

xabbuh removed the Deprecation label Dec 15, 2016

ro0NL mentioned this pull request Dec 17, 2016

[HttpFoundation] Improved set cookie header tests #20972

Closed

[HttpFoundation] Create cookie from string + synchronize response coo…

7314456

…kies

fabpot merged commit 7314456 into symfony:master Dec 17, 2016

ro0NL deleted the http-foundation/cookie-from-string branch December 17, 2016 19:31

xabbuh mentioned this pull request Dec 19, 2016

Documentation for Cookie::from string() symfony/symfony-docs#7278

Closed

xabbuh mentioned this pull request Dec 19, 2016

[HttpFoundation] update changelog #20986

Merged

This was referenced Dec 19, 2016

[WebProfilerBundle] Display multiple HTTP headers in WDT #20599

Merged

[HttpKernel] Continuation of #20569 #21001

Merged

nicolas-grekas modified the milestones: 3.x, 3.3 Mar 24, 2017

fabpot mentioned this pull request May 1, 2017

Release v3.3.0-BETA1 #22603

Merged

thomxc mentioned this pull request Jun 1, 2017

Array values in a Cookie throws an Exception since Symfony v3.3 laravel/framework#19443

Closed

ro0NL mentioned this pull request Sep 13, 2017

[HttpKernel] Dont store response cookies with HttpCache #24190

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[HttpFoundation] Create cookie from string + synchronize response cookies #20569

[HttpFoundation] Create cookie from string + synchronize response cookies #20569

ro0NL commented Nov 19, 2016 •

edited

Loading

HeahDude Nov 19, 2016

HeahDude commented Nov 19, 2016

ro0NL commented Nov 19, 2016 •

edited

Loading

ro0NL commented Nov 19, 2016

ro0NL commented Nov 19, 2016

HeahDude Nov 19, 2016

ro0NL Nov 20, 2016

ro0NL commented Nov 20, 2016

fabpot Dec 13, 2016

ro0NL Dec 13, 2016

ro0NL Dec 13, 2016

fabpot Dec 13, 2016

ro0NL Dec 13, 2016

stof Dec 13, 2016

stof Dec 13, 2016

ro0NL Dec 13, 2016

ro0NL Dec 13, 2016

stof Dec 13, 2016

stof Dec 13, 2016

ro0NL Dec 13, 2016

ro0NL commented Dec 17, 2016

fabpot commented Dec 17, 2016

[HttpFoundation] Create cookie from string + synchronize response cookies #20569

[HttpFoundation] Create cookie from string + synchronize response cookies #20569

Conversation

ro0NL commented Nov 19, 2016 • edited Loading

Choose a reason for hiding this comment

HeahDude commented Nov 19, 2016

ro0NL commented Nov 19, 2016 • edited Loading

ro0NL commented Nov 19, 2016

ro0NL commented Nov 19, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ro0NL commented Nov 20, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ro0NL commented Dec 17, 2016

fabpot commented Dec 17, 2016

ro0NL commented Nov 19, 2016 •

edited

Loading

ro0NL commented Nov 19, 2016 •

edited

Loading