Hsnmohd commented on code in PR #924:
URL:
https://github.com/apache/httpcomponents-client/pull/924#discussion_r4487240109
##########
httpclient5/src/main/java/org/apache/hc/client5/http/protocol/RequestAddCookies.java:
##########
@@ -108,23 +108,20 @@ public void process(final HttpRequest request, final
EntityDetails entity, final
Args.notNull(request, "HTTP request");
Args.notNull(context, "HTTP context");
+ final HttpClientContext clientContext =
HttpClientContext.cast(context);
+ final String exchangeId = clientContext.getExchangeId();
+
+ // Discard the CookieSpec and CookieOrigin of a previous exchange
executed with
+ // this context so the response interceptor never processes Set-Cookie
headers
+ // against the origin of another request
+ clientContext.setCookieSpec(null);
+ clientContext.setCookieOrigin(null);
+
Review Comment:
Agreed, that's the safer default. Pushed 0bdcb88: the Cookie header check is
back right after the CONNECT/TRACE exit, so with a caller-set header the spec
and origin stay null (the reset at the top still clears whatever the previous
exchange left) and ResponseProcessCookies skips the response. The regression
test now asserts both are null in that case.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
