diff --git a/src/Io/ServerRequest.php b/src/Io/ServerRequest.php index 787960dd..28a8c5db 100644 --- a/src/Io/ServerRequest.php +++ b/src/Io/ServerRequest.php @@ -57,7 +57,13 @@ public function __construct( \parse_str($query, $this->queryParams); } - $this->cookies = $this->parseCookie($this->getHeaderLine('Cookie')); + // Multiple cookie headers are not allowed according + // to https://tools.ietf.org/html/rfc6265#section-5.4 + $cookieHeaders = $this->getHeader("Cookie"); + + if (count($cookieHeaders) === 1) { + $this->cookies = $this->parseCookie($cookieHeaders[0]); + } } public function getServerParams() @@ -146,10 +152,7 @@ public function withoutAttribute($name) */ private function parseCookie($cookie) { - // PSR-7 `getHeaderLine('Cookie')` will return multiple - // cookie header comma-seperated. Multiple cookie headers - // are not allowed according to https://tools.ietf.org/html/rfc6265#section-5.4 - if ($cookie === '' || \strpos($cookie, ',') !== false) { + if ($cookie === '') { return array(); } diff --git a/tests/StreamingServerTest.php b/tests/StreamingServerTest.php index 1e7f7330..8423e3ea 100644 --- a/tests/StreamingServerTest.php +++ b/tests/StreamingServerTest.php @@ -2790,6 +2790,25 @@ public function testRequestCookieWithSeparatorWillBeAddedToServerRequest() $this->assertEquals(array('hello' => 'world', 'test' => 'abc'), $requestValidation->getCookieParams()); } + public function testRequestCookieWithCommaValueWillBeAddedToServerRequest() { + $requestValidation = null; + $server = new StreamingServer(function (ServerRequestInterface $request) use (&$requestValidation) { + $requestValidation = $request; + }); + + $server->listen($this->socket); + $this->socket->emit('connection', array($this->connection)); + + $data = "GET / HTTP/1.1\r\n"; + $data .= "Host: example.com:80\r\n"; + $data .= "Connection: close\r\n"; + $data .= "Cookie: test=abc,def; hello=world\r\n"; + $data .= "\r\n"; + + $this->connection->emit('data', array($data)); + $this->assertEquals(array('test' => 'abc,def', 'hello' => 'world'), $requestValidation->getCookieParams()); + } + private function createGetRequest() { $data = "GET / HTTP/1.1\r\n";